<?php
// index.php - Single-file Music Distribution (PHP + SQLite)
// Requirements: PHP 7.4+, pdo_sqlite enabled, writable ./uploads directory
session_start();

// --- CONFIG ---
const DB_FILE = __DIR__ . '/music_dist.sqlite';
const UPLOAD_DIR = __DIR__ . '/uploads';
const MAX_UPLOAD_BYTES = 20 * 1024 * 1024; // 20 MB

if (!file_exists(UPLOAD_DIR)) {
    mkdir(UPLOAD_DIR, 0775, true);
}

// --- DB INIT ---
try {
    $pdo = new PDO('sqlite:' . DB_FILE);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // create tables if missing
    $pdo->exec("CREATE TABLE IF NOT EXISTS users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        name TEXT,
        email TEXT UNIQUE,
        password TEXT,
        role TEXT DEFAULT 'user',
        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
    )");

    $pdo->exec("CREATE TABLE IF NOT EXISTS tracks (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER,
        title TEXT,
        artist TEXT,
        album TEXT,
        genre TEXT,
        filename TEXT,
        filesize INTEGER,
        mime TEXT,
        status TEXT DEFAULT 'pending', -- pending | approved | rejected
        notes TEXT,
        uploaded_at DATETIME DEFAULT CURRENT_TIMESTAMP,
        FOREIGN KEY(user_id) REFERENCES users(id)
    )");
} catch (Exception $e) {
    die("DB error: " . htmlspecialchars($e->getMessage()));
}

// create default admin if not exists
$admin_email = 'admin@demo.com';
$stmt = $pdo->prepare("SELECT id FROM users WHERE email = ?");
$stmt->execute([$admin_email]);
if (!$stmt->fetch()) {
    $pdo->prepare("INSERT INTO users (name,email,password,role) VALUES (?,?,?,?)")
        ->execute(['Admin', $admin_email, password_hash('admin123', PASSWORD_DEFAULT), 'admin']);
}

// --- Helper functions ---
function is_logged() { return isset($_SESSION['user_id']); }
function is_admin() { return (isset($_SESSION['role']) && $_SESSION['role'] === 'admin'); }
function redirect($url) { header("Location: $url"); exit; }
function e($s) { return htmlspecialchars($s ?? '', ENT_QUOTES); }

// --- AUTH: register / login / logout ---
$action = $_REQUEST['action'] ?? null;

if ($action === 'register' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = trim($_POST['name'] ?? '');
    $email = trim($_POST['email'] ?? '');
    $pass = $_POST['password'] ?? '';

    if ($name && filter_var($email, FILTER_VALIDATE_EMAIL) && strlen($pass) >= 6) {
        $hash = password_hash($pass, PASSWORD_DEFAULT);
        try {
            $pdo->prepare("INSERT INTO users (name,email,password) VALUES (?,?,?)")
                ->execute([$name, $email, $hash]);
            $_SESSION['flash'] = "Registration successful. Please login.";
            redirect('./');
        } catch (Exception $e) {
            $_SESSION['flash'] = "Error: " . e($e->getMessage());
            redirect('./?view=auth');
        }
    } else {
        $_SESSION['flash'] = "Please provide valid name, email and password (6+ chars).";
        redirect('./?view=auth');
    }
}

if ($action === 'login' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = trim($_POST['email'] ?? '');
    $pass = $_POST['password'] ?? '';
    $stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
    $stmt->execute([$email]);
    $u = $stmt->fetch(PDO::FETCH_ASSOC);
    if ($u && password_verify($pass, $u['password'])) {
        $_SESSION['user_id'] = $u['id'];
        $_SESSION['name'] = $u['name'];
        $_SESSION['role'] = $u['role'];
        $_SESSION['flash'] = "Welcome, " . $u['name'];
        redirect('./');
    } else {
        $_SESSION['flash'] = "Invalid credentials.";
        redirect('./?view=auth');
    }
}

if ($action === 'logout') {
    session_unset();
    session_destroy();
    session_start();
    $_SESSION['flash'] = "Logged out.";
    redirect('./');
}

// --- UPLOAD track (user) ---
if ($action === 'upload' && $_SERVER['REQUEST_METHOD'] === 'POST' && is_logged()) {
    $title = trim($_POST['title'] ?? '');
    $artist = trim($_POST['artist'] ?? '');
    $album = trim($_POST['album'] ?? '');
    $genre = trim($_POST['genre'] ?? '');
    if (!isset($_FILES['track']) || $_FILES['track']['error'] !== UPLOAD_ERR_OK) {
        $_SESSION['flash'] = "Please choose a file to upload.";
        redirect('./?view=dashboard');
    }
    $f = $_FILES['track'];
    if ($f['size'] > MAX_UPLOAD_BYTES) {
        $_SESSION['flash'] = "File too large (max 20MB).";
        redirect('./?view=dashboard');
    }
    // Basic mime validation
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $f['tmp_name']);
    finfo_close($finfo);
    $allowed = ['audio/mpeg','audio/mp3','audio/wav','audio/x-wav','audio/flac','audio/x-flac'];
    if (!in_array($mime, $allowed)) {
        $_SESSION['flash'] = "Unsupported audio format: " . e($mime) . ". Allowed: mp3/wav/flac.";
        redirect('./?view=dashboard');
    }

    $ext = pathinfo($f['name'], PATHINFO_EXTENSION);
    $basename = bin2hex(random_bytes(8)) . '.' . $ext;
    $dest = UPLOAD_DIR . '/' . $basename;
    if (!move_uploaded_file($f['tmp_name'], $dest)) {
        $_SESSION['flash'] = "Failed to move uploaded file.";
        redirect('./?view=dashboard');
    }
    // insert track record
    $pdo->prepare("INSERT INTO tracks (user_id,title,artist,album,genre,filename,filesize,mime) VALUES (?,?,?,?,?,?,?,?)")
        ->execute([$_SESSION['user_id'],$title,$artist,$album,$genre,$basename,$f['size'],$mime]);

    $_SESSION['flash'] = "Track uploaded and awaiting admin approval.";
    redirect('./?view=dashboard');
}

// --- ADMIN actions: approve/reject/delete ---
if (is_admin() && $action === 'admin_action' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $sub = $_POST['subaction'] ?? '';
    $track_id = (int)($_POST['track_id'] ?? 0);
    if ($sub === 'approve') {
        $pdo->prepare("UPDATE tracks SET status = 'approved', notes = ? WHERE id = ?")
            ->execute([trim($_POST['notes'] ?? 'Approved'), $track_id]);
        $_SESSION['flash'] = "Track approved.";
    } elseif ($sub === 'reject') {
        $pdo->prepare("UPDATE tracks SET status = 'rejected', notes = ? WHERE id = ?")
            ->execute([trim($_POST['notes'] ?? 'Rejected'), $track_id]);
        $_SESSION['flash'] = "Track rejected.";
    } elseif ($sub === 'delete') {
        $stmt = $pdo->prepare("SELECT filename FROM tracks WHERE id = ?");
        $stmt->execute([$track_id]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        if ($row) {
            $file = UPLOAD_DIR . '/' . $row['filename'];
            if (file_exists($file)) @unlink($file);
            $pdo->prepare("DELETE FROM tracks WHERE id = ?")->execute([$track_id]);
            $_SESSION['flash'] = "Track deleted.";
        }
    }
    redirect('./?view=admin');
}

// --- ROUTES: simple view router ---
$view = $_GET['view'] ?? 'home';

// small helpers for queries
function get_latest_tracks($pdo, $limit=12) {
    $stmt = $pdo->prepare("SELECT t.*, u.name as uploader FROM tracks t LEFT JOIN users u ON u.id=t.user_id WHERE t.status='approved' ORDER BY t.uploaded_at DESC LIMIT ?");
    $stmt->execute([$limit]);
    return $stmt->fetchAll(PDO::FETCH_ASSOC);
}
function get_user_tracks($pdo, $user_id) {
    $stmt = $pdo->prepare("SELECT * FROM tracks WHERE user_id = ? ORDER BY uploaded_at DESC");
    $stmt->execute([$user_id]);
    return $stmt->fetchAll(PDO::FETCH_ASSOC);
}
function get_all_tracks($pdo) {
    $stmt = $pdo->query("SELECT t.*, u.name as uploader FROM tracks t LEFT JOIN users u ON u.id=t.user_id ORDER BY t.uploaded_at DESC");
    return $stmt->fetchAll(PDO::FETCH_ASSOC);
}
function get_users($pdo) {
    $stmt = $pdo->query("SELECT id,name,email,role,created_at FROM users ORDER BY created_at DESC");
    return $stmt->fetchAll(PDO::FETCH_ASSOC);
}

// --- Flash messages ---
$flash = $_SESSION['flash'] ?? null;
unset($_SESSION['flash']);

?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover" />
<title>Playnex Mini — Music Distribution</title>
<meta name="description" content="Professional music distribution demo with user & admin dashboards" />
<style>
/* ---------- Simple modern CSS (mobile-first) ---------- */
:root{
  --bg:#0f1724; --card:#0b1220; --accent:#7c3aed; --muted:#9aa4b2; --glass: rgba(255,255,255,0.03);
  --outline: 2px solid rgba(255,255,255,0.06);
  font-family: Inter, ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial;
}
*{box-sizing:border-box}
html,body{height:100%}
body{
  margin:0; background:linear-gradient(180deg,#031029 0%, #071526 60%); color:#e6eef8;
  -webkit-font-smoothing:antialiased; -moz-osx-font-smoothing:grayscale;
  padding:18px;
}

/* Layout */
.container{max-width:1100px;margin:0 auto}
.header{display:flex;gap:12px;align-items:center;justify-content:space-between;margin-bottom:18px}
.brand{display:flex;gap:12px;align-items:center}
.logo{
  width:56px;height:56px;border-radius:12px;background:linear-gradient(135deg,var(--accent),#2dd4bf);
  display:flex;align-items:center;justify-content:center;font-weight:700;font-size:20px;color:#031029;box-shadow:0 6px 30px rgba(0,0,0,0.6)
}
.title{font-size:18px;font-weight:600}
.nav{display:flex;gap:8px;align-items:center}

/* Outlined animated button */
.btn {
  background:transparent;border-radius:12px;padding:10px 14px;font-weight:600;border:var(--outline);
  color:var(--muted);cursor:pointer;backdrop-filter: blur(6px);transition: transform .15s ease, box-shadow .15s;
  display:inline-flex;gap:8px;align-items:center;
}
.btn:hover{transform: translateY(-4px); color: #fff; box-shadow: 0 10px 30px rgba(0,0,0,0.5)}
.btn:active{transform: scale(.98) translateY(-2px)}

/* Primary */
.btn-primary{border: 2px solid rgba(124,58,237,0.9); background: linear-gradient(180deg, rgba(124,58,237,0.06), transparent); color: #e9e7ff}
.btn-ghost{border: 2px dashed rgba(255,255,255,0.04)}

/* Grid */
.grid{display:grid;grid-template-columns:1fr;gap:14px}
@media(min-width:900px){ .grid{grid-template-columns: 2fr 1fr} }

/* Card */
.card{background:var(--card);border-radius:14px;padding:16px;border:1px solid rgba(255,255,255,0.03);box-shadow: 0 8px 30px rgba(2,6,23,0.6)}
.small{font-size:13px;color:var(--muted)}

/* Track list */
.track{display:flex;gap:12px;align-items:center;padding:12px;border-radius:10px;border:1px solid rgba(255,255,255,0.02);transition:background .12s}
.track:hover{background: rgba(255,255,255,0.01)}
.track .meta{flex:1}
.track .controls{display:flex;gap:8px}

/* Form */
.form-row{display:flex;flex-direction:column;gap:8px;margin-bottom:10px}
.input, textarea, select{
  background:transparent;border-radius:10px;padding:10px;border:1px solid rgba(255,255,255,0.04);color: #e6eef8;
  outline:none;font-size:14px
}
.file{padding:8px;border-radius:10px;border:1px dashed rgba(255,255,255,0.03);text-align:center}

/* Tiny badges */
.badge{padding:6px 8px;border-radius:999px;font-weight:700;font-size:12px}
.badge-pending{background:rgba(255,195,0,0.12);color:#ffd86b}
.badge-approved{background:rgba(34,197,94,0.12);color:#9ff4be}
.badge-rejected{background:rgba(239,68,68,0.08);color:#ffb3b3}

/* footer */
.footer{margin-top:18px;text-align:center;color:var(--muted);font-size:13px}

/* little animated ripple for clicks */
.ripple { position: relative; overflow: hidden; }
.ripple:after {
  content: ""; position: absolute; left: 50%; top: 50%; width: 8px; height: 8px; background: rgba(255,255,255,0.08);
  transform: translate(-50%,-50%) scale(1); opacity: 0; border-radius: 999px; transition: transform .45s, opacity .45s;
}
.ripple:active:after { transform: translate(-50%,-50%) scale(60); opacity: 1; transition: transform .6s, opacity .6s; }
</style>
<link rel="me" href="https://www.blogger.com/profile/07890461975602793421" />
<meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/>
<meta name='google-adsense-platform-domain' content='blogspot.com'/>
</head>
<body>
<div class="container">

  <header class="header">
    <div class="brand">
      <div class="logo">PX</div>
      <div>
        <div class="title">Playnex Mini — Music Distribution</div>
        <div class="small">Upload · Approve · Distribute (demo)</div>
      </div>
    </div>

    <nav class="nav">
      <a class="btn btn-ghost" href="./">Home</a>
      <?php if (!is_logged()): ?>
        <a class="btn" href="./?view=auth">Login / Register</a>
      <?php else: ?>
        <a class="btn" href="./?view=dashboard">Dashboard</a>
        <?php if (is_admin()): ?><a class="btn btn-primary" href="./?view=admin">Admin</a><?php endif; ?>
        <a class="btn" href="./?action=logout">Logout</a>
      <?php endif; ?>
    </nav>
  </header>

  <?php if ($flash): ?>
    <div class="card small" style="margin-bottom:12px;background:linear-gradient(90deg, rgba(124,58,237,0.06), transparent)">
      <?= e($flash) ?>
    </div>
  <?php endif; ?>

  <?php if ($view === 'home'): ?>
    <div class="grid">
      <div class="card">
        <h3>Latest Releases</h3>
        <p class="small">Approved tracks available for streaming / distribution preview.</p>
        <div style="margin-top:12px">
          <?php $tracks = get_latest_tracks($pdo, 12); if (!$tracks): ?>
            <div class="small">No released tracks yet. Upload and wait for admin approval.</div>
          <?php endif; ?>
          <?php foreach ($tracks as $t): ?>
            <div class="track" style="margin-bottom:8px">
              <div style="width:64px;height:64px;border-radius:8px;background:linear-gradient(180deg,#071526,#0b2540);display:flex;align-items:center;justify-content:center;font-weight:700">
                🎵
              </div>
              <div class="meta">
                <div style="font-weight:700"><?= e($t['title']) ?></div>
                <div class="small"><?= e($t['artist']) ?> · <?= e($t['uploader']) ?> · <?= e(substr($t['uploaded_at'],0,10)) ?></div>
              </div>
              <div class="controls">
                <audio controls preload="none" style="height:36px">
                  <source src="<?= './uploads/' . e($t['filename']) ?>" type="<?= e($t['mime']) ?>">
                  Your browser does not support audio playback.
                </audio>
              </div>
            </div>
          <?php endforeach; ?>
        </div>
      </div>

      <aside class="card">
        <h4>Quick Actions</h4>
        <div style="display:flex;flex-direction:column;gap:8px;margin-top:12px">
          <?php if (!is_logged()): ?>
            <a class="btn btn-primary ripple" href="./?view=auth">Sign up to upload</a>
          <?php else: ?>
            <a class="btn ripple" href="./?view=dashboard">Go to dashboard</a>
          <?php endif; ?>
          <a class="btn" href="#" onclick="alert('This demo has no payment gateway. Integrate Stripe/PayPal in production.')">Pricing & Plans</a>
        </div>
        <hr style="margin:12px 0;border:none;border-top:1px solid rgba(255,255,255,0.03)">
        <div class="small">Need custom distribution (ISRC, DDEX feed, DSP onboarding)? Contact your dev team to integrate with distribution partners and payment providers.</div>
      </aside>
    </div>

  <?php elseif ($view === 'auth'): ?>
    <div class="card" style="max-width:720px;margin:0 auto">
      <h3>Login / Register</h3>
      <div style="display:flex;gap:12px;flex-direction:column">
        <form method="post" action="./?action=login" style="display:flex;flex-direction:column">
          <div class="form-row">
            <label class="small">Email</label>
            <input class="input" type="email" name="email" required />
          </div>
          <div class="form-row">
            <label class="small">Password</label>
            <input class="input" type="password" name="password" required />
          </div>
          <div style="display:flex;gap:8px">
            <button class="btn btn-primary ripple" type="submit">Login</button>
            <a class="btn" href="#register" onclick="document.getElementById('register').scrollIntoView()">Register</a>
          </div>
        </form>

        <div id="register" style="margin-top:18px">
          <h4>Create account</h4>
          <form method="post" action="./?action=register">
            <div class="form-row"><label class="small">Name</label><input class="input" name="name" required></div>
            <div class="form-row"><label class="small">Email</label><input class="input" type="email" name="email" required></div>
            <div class="form-row"><label class="small">Password (6+ chars)</label><input class="input" type="password" name="password" minlength="6" required></div>
            <div style="display:flex;gap:8px"><button class="btn btn-primary ripple" type="submit">Register</button></div>
          </form>
        </div>
      </div>
    </div>

  <?php elseif ($view === 'dashboard' && is_logged()): ?>
    <div class="grid">
      <div class="card">
        <h3>My Dashboard</h3>
        <div class="small">Hello, <?= e($_SESSION['name']) ?> — Upload tracks and track their approval status.</div>

        <section style="margin-top:12px">
          <h4>Upload Track</h4>
          <form method="post" action="./?action=upload" enctype="multipart/form-data">
            <div class="form-row"><label class="small">Title</label><input class="input" name="title" required></div>
            <div class="form-row"><label class="small">Artist</label><input class="input" name="artist" value="<?= e($_SESSION['name']) ?>"></div>
            <div class="form-row"><label class="small">Album</label><input class="input" name="album"></div>
            <div class="form-row"><label class="small">Genre</label><input class="input" name="genre"></div>
            <div class="form-row"><label class="small">Audio file (mp3/wav/flac) — max 20MB</label>
              <div class="file">
                <input type="file" accept="audio/*" name="track" required />
              </div>
            </div>
            <div style="display:flex;gap:8px"><button class="btn btn-primary ripple" type="submit">Upload & Submit</button></div>
          </form>
        </section>

        <section style="margin-top:16px">
          <h4>My Uploads</h4>
          <?php $my = get_user_tracks($pdo, $_SESSION['user_id']); if (!$my): ?>
            <div class="small">No uploads yet.</div>
          <?php endif; ?>
          <?php foreach ($my as $m): ?>
            <div class="track">
              <div style="width:54px;height:54px;border-radius:8px;background:#061424;display:flex;align-items:center;justify-content:center">🎧</div>
              <div class="meta">
                <div style="font-weight:700"><?= e($m['title']) ?> <span class="small">· <?= e($m['artist']) ?></span></div>
                <div class="small">Uploaded: <?= e(substr($m['uploaded_at'],0,10)) ?> · Size: <?= round($m['filesize']/1024/1024,2) ?>MB</div>
                <div style="margin-top:6px">
                  <?php if ($m['status'] === 'pending'): ?><span class="badge badge-pending">Pending</span><?php endif; ?>
                  <?php if ($m['status'] === 'approved'): ?><span class="badge badge-approved">Approved</span><?php endif; ?>
                  <?php if ($m['status'] === 'rejected'): ?><span class="badge badge-rejected">Rejected</span><?php endif; ?>
                  <?php if ($m['notes']): ?><div class="small" style="margin-top:6px;color:#cfd8e3">Admin note: <?= e($m['notes']) ?></div><?php endif; ?>
                </div>
              </div>
              <div class="controls">
                <?php if ($m['status'] === 'approved'): ?>
                  <audio controls preload="none" style="height:36px"><source src="<?= './uploads/' . e($m['filename']) ?>" type="<?= e($m['mime']) ?>"></audio>
                <?php else: ?>
                  <button class="btn" onclick="alert('Track not approved yet')">Preview</button>
                <?php endif; ?>
              </div>
            </div>
          <?php endforeach; ?>
        </section>
      </div>

      <aside class="card">
        <h4>Account</h4>
        <div class="small">Name: <?= e($_SESSION['name']) ?></div>
        <div class="small">Role: <?= e($_SESSION['role']) ?></div>
        <hr style="margin:12px 0;border:none;border-top:1px solid rgba(255,255,255,0.03)">
        <h4>Distribution Notes</h4>
        <div class="small">This demo does basic approval workflows. For real distribution you need ISRCs, metadata feeds (DDEX), transcoding to DSP specs, and partner onboarding.</div>
      </aside>
    </div>

  <?php elseif ($view === 'admin' && is_admin()): ?>
    <div class="card">
      <h3>Admin Panel</h3>
      <div class="small">Approve, reject or delete uploads. Download raw files and manage users.</div>
      <hr style="margin:12px 0;border:none;border-top:1px solid rgba(255,255,255,0.03)">
      <h4>Pending & All Tracks</h4>
      <?php $all = get_all_tracks($pdo); if (!$all): ?>
        <div class="small">No tracks yet.</div>
      <?php endif; ?>
      <?php foreach ($all as $t): ?>
        <div class="track" style="margin-bottom:8px">
          <div style="width:64px;height:64px;border-radius:8px;background:#071526;display:flex;align-items:center;justify-content:center">🎵</div>
          <div class="meta">
            <div style="font-weight:700"><?= e($t['title']) ?> <span class="small">· <?= e($t['artist']) ?></span></div>
            <div class="small"><?= e($t['uploader']) ?> · <?= e($t['uploaded_at']) ?></div>
            <div style="margin-top:6px">
              <?php if ($t['status'] === 'pending'): ?><span class="badge badge-pending">Pending</span><?php endif; ?>
              <?php if ($t['status'] === 'approved'): ?><span class="badge badge-approved">Approved</span><?php endif; ?>
              <?php if ($t['status'] === 'rejected'): ?><span class="badge badge-rejected">Rejected</span><?php endif; ?>
              <?php if ($t['notes']): ?><div class="small" style="margin-top:6px;color:#cfd8e3">Note: <?= e($t['notes']) ?></div><?php endif; ?>
            </div>
          </div>

          <div class="controls">
            <audio controls preload="none" style="height:36px"><source src="<?= './uploads/' . e($t['filename']) ?>" type="<?= e($t['mime']) ?>"></audio>
            <div style="display:flex;flex-direction:column;gap:6px;margin-left:8px">
              <form method="post" action="./?action=admin_action">
                <input type="hidden" name="track_id" value="<?= e($t['id']) ?>">
                <input type="text" name="notes" placeholder="Notes" class="input" style="width:200px;margin-bottom:6px">
                <div style="display:flex;gap:6px">
                  <button class="btn btn-primary" type="submit" name="subaction" value="approve">Approve</button>
                  <button class="btn" type="submit" name="subaction" value="reject">Reject</button>
                  <button class="btn" type="submit" name="subaction" value="delete" onclick="return confirm('Delete this track?')">Delete</button>
                </div>
              </form>
              <a class="btn" href="<?= './uploads/' . e($t['filename']) ?>" download>Download</a>
            </div>
          </div>
        </div>
      <?php endforeach; ?>

      <hr style="margin:12px 0;border:none;border-top:1px solid rgba(255,255,255,0.03)">
      <h4>Users</h4>
      <?php $users = get_users($pdo); if (!$users): ?><div class="small">No users.</div><?php endif; ?>
      <?php foreach ($users as $u): ?>
        <div style="display:flex;justify-content:space-between;align-items:center;padding:8px;border-radius:8px;border:1px solid rgba(255,255,255,0.02);margin-bottom:8px">
          <div>
            <div style="font-weight:700"><?= e($u['name']) ?> <span class="small"><?= e($u['email']) ?></span></div>
            <div class="small">Role: <?= e($u['role']) ?> · Joined: <?= e(substr($u['created_at'],0,10)) ?></div>
          </div>
          <div><button class="btn">View</button></div>
        </div>
      <?php endforeach; ?>
    </div>

  <?php else: ?>
    <div class="card"><div class="small">Please log in to view this page.</div></div>
  <?php endif; ?>

  <div class="footer small">Demo — built as a single-file starter. Default admin: <strong>admin@demo.com</strong> / <strong>admin123</strong></div>

</div>

</body>
</html>