<?php require_once __DIR__.'/../includes/auth.php'; require_login(['manager','admin']);
if($_SERVER['REQUEST_METHOD']==='POST'){ verify_csrf(); db()->prepare('INSERT INTO practical_signoffs(user_id, course_id, signed_by, notes, status) VALUES(?,?,?,?,"signed_off")')->execute([$_POST['user_id'],$_POST['course_id'],current_user()['id'],$_POST['notes']]);
$passed=db()->prepare('SELECT id FROM course_progress WHERE user_id=? AND course_id=? AND status="passed"'); $passed->execute([$_POST['user_id'],$_POST['course_id']]);
if($passed->fetch()){ db()->prepare('INSERT IGNORE INTO certificates(user_id,course_id,certificate_code,issued_at) VALUES(?,?,?,NOW())')->execute([$_POST['user_id'],$_POST['course_id'],'FSA-'.strtoupper(bin2hex(random_bytes(4)))]); }
$notice='Practical sign-off saved.'; }
$staff=db()->query('SELECT id,first_name,last_name FROM users WHERE role="staff" ORDER BY first_name')->fetchAll(); $courses=db()->query('SELECT id,title FROM courses WHERE requires_practical=1 ORDER BY title')->fetchAll(); require __DIR__.'/../includes/header.php'; ?>
<div class="card"><h1>Practical Sign-Off</h1><?php if(!empty($notice)): ?><p class="correct"><?= $notice ?></p><?php endif; ?><form method="post"><input type="hidden" name="csrf" value="<?= csrf_token() ?>"><label>Employee</label><select name="user_id"><?php foreach($staff as $s): ?><option value="<?= $s['id'] ?>"><?= htmlspecialchars($s['first_name'].' '.$s['last_name']) ?></option><?php endforeach; ?></select><label>Course</label><select name="course_id"><?php foreach($courses as $c): ?><option value="<?= $c['id'] ?>"><?= htmlspecialchars($c['title']) ?></option><?php endforeach; ?></select><label>Manager Notes</label><textarea name="notes" rows="5" placeholder="Example: probes correctly, follows build guide, maintains portion control"></textarea><button>Save Sign-Off</button></form></div><?php require __DIR__.'/../includes/footer.php'; ?>
