# ═══════════════════════════════════════════════════════════════
# PHASE 13: SYSTEM ADMINISTRATION MODULE
# Module directory: /modules/admin/
# ═══════════════════════════════════════════════════════════════
# READ THE MASTER PROMPT FIRST.

## YOUR TABLES
auth_users (CRUD), auth_roles (CRUD), auth_permissions (read),
auth_role_permissions (manage), auth_user_roles (manage),
departments, staff, staff_positions, staff_shifts, staff_tasks,
staff_performance_reviews, system_jobs, system_job_runs,
data_quality_rules, data_quality_issues, data_quality_scan_runs,
import_batches, import_batch_rows, export_log,
file_attachments, recycle_bin, data_change_log, api_request_log,
sys_form_number_pools, sys_form_number_issued, sys_translations,
sys_lookup_categories, sys_lookup_values, sys_config (CRUD)

## PAGES TO BUILD

### 1. User Management (`GET /admin/users`)
- DataTable: Username, Email, Full Name, Roles, Active, Last Login
- Create/Edit user (full_name, email, username, password, roles, active toggle)
- Lock/unlock user
- Force password change
- View user sessions

### 2. Role Management (`GET /admin/roles`)
- DataTable of roles
- Create/Edit role with permission assignment
- Permission matrix: modules as rows, CRUD+approve as columns
- Checkbox grid interface

### 3. System Settings (`GET /admin/settings`)
- Grouped settings from sys_config
- Tabs by config_group: Club, Financial, Security, Email, SMS, Membership, System, Booking, Guest, etc.
- Inline edit per setting
- Change log (config_change_log)

### 4. Departments (`GET /admin/departments`)
- CRUD with tree structure (parent_id)
- Manager assignment

### 5. Staff Management (`GET /admin/staff`)
- DataTable and CRUD for staff
- Link to user account
- Position assignment
- Shift management
- Task assignment and tracking
- Performance reviews

### 6. System Jobs (`GET /admin/jobs`)
- DataTable of system_jobs with status
- Enable/disable toggle
- Manual run trigger
- Run history (system_job_runs)
- Last run status, next run time

### 7. Audit Log Viewer (`GET /admin/audit-log`)
- DataTable of audit_log
- Filters: User, Action, Module, Entity, Date Range, Severity
- Detail view showing old/new values

### 8. Login Log (`GET /admin/login-log`)
- DataTable of login_log
- Filter by user, action, IP

### 9. Data Quality (`GET /admin/data-quality`)
- Rules management (data_quality_rules CRUD)
- Scan runs history
- Issues viewer with filters
- Fix/Acknowledge/Ignore actions
- Trigger scan button

### 10. Import Tool (`GET /admin/import`)
- Upload CSV/Excel file
- Select import type (members, subscriptions, payments)
- Column mapping interface
- Validation preview (show errors before import)
- Execute import
- Import history with rollback option

### 11. Export Log (`GET /admin/export-log`)
- History of all exports by all users

### 12. Recycle Bin (`GET /admin/recycle-bin`)
- DataTable of soft-deleted entities
- Restore functionality
- Permanent delete (with confirmation)
- Auto-purge policy

### 13. Lookup Values (`GET /admin/lookups`)
- Manage sys_lookup_categories and sys_lookup_values
- Dynamic CRUD per category

### 14. Translations (`GET /admin/translations`)
- Manage sys_translations
- Filter by language and group
- Inline edit

### 15. Form Number Pools (`GET /admin/form-numbers`)
- Manage form number pools
- Issue form numbers
- Track usage

### 16. Sequence Management (`GET /admin/sequences`)
- View/edit sys_sequences
- Reset sequences (with confirmation)

### 17. System Health
- PHP info, DB version, storage usage
- Active sessions count
- Queue status
- Error log viewer (recent from system_error_log)

## BUSINESS LOGIC
- User password hashed with password_hash(PASSWORD_BCRYPT)
- System role (is_system=1) cannot be deleted
- Super admin role always has all permissions
- Import validates each row before insert, creates batch record
- Recycle bin auto-purges after restore_deadline
- Data quality scan checks all active rules

## DASHBOARD WIDGETS
1. **System Health** — Active users, sessions, errors today
2. **Data Quality** — Open issues count by severity

## PERMISSIONS
users.view, users.manage, roles.manage,
settings.view, settings.manage,
audit.view, staff.view, staff.manage,
import.execute, export.execute