isOwner()
&& !$adminAuth->hasPermission('support')
&& !$adminAuth->hasPermission('withdrawals')) {
http_response_code(403);
echo 'Access Denied';
exit;
}
// ── Active tab resolution (SSR default) ─────────────────────────────
// The tab is only used to decide which div is visible on first paint and
// to gate the AJAX endpoints. Tab switching itself is fully client-side.
$tab = $_GET['tab'] ?? 'tickets';
if (!in_array($tab, ['tickets', 'withdrawals'], true)) {
$tab = 'tickets';
}
// Hide a tab from a user who lacks its specific permission. (Owner sees both.)
$canTickets = $adminAuth->isOwner() || $adminAuth->hasPermission('support');
$canWithdrawals = $adminAuth->isOwner() || $adminAuth->hasPermission('withdrawals');
// If the requested tab isn't accessible, fall back to whichever tab is.
if ($tab === 'tickets' && !$canTickets) {
$tab = $canWithdrawals ? 'withdrawals' : 'tickets';
}
if ($tab === 'withdrawals' && !$canWithdrawals) {
$tab = $canTickets ? 'tickets' : 'withdrawals';
}
// ── AJAX: tickets list ───────────────────────────────────────────────
// Both AJAX endpoints are always reachable on this page (regardless of which
// tab is currently visible) so the polling never breaks when the user toggles
// tabs. The permission check above already gates the page itself.
if (isset($_GET['ajax']) && $_GET['ajax'] === 'tickets_list' && $canTickets) {
header('Content-Type: application/json; charset=utf-8');
$tickets = Database::getAllTickets(100);
$openCount = 0;
$rows = [];
foreach ($tickets as $t) {
if ($t['status'] !== 'closed') $openCount++;
$rows[] = [
'id' => (int)$t['id'],
'user_id' => (string)$t['user_id'],
'user_name' => $t['user_name'] ?? ('user ' . $t['user_id']),
'question' => mb_substr($t['question'], 0, 80),
'full_q' => mb_strlen($t['question']) > 80,
'status' => $t['status'],
'admin_name' => $t['admin_name'] ?? '',
'time' => $t['question_time'],
];
}
echo json_encode(['total' => count($rows), 'open' => $openCount, 'rows' => $rows]);
exit;
}
// ── AJAX: withdrawals list ───────────────────────────────────────────
if (isset($_GET['ajax']) && $_GET['ajax'] === 'withdrawals_list' && $canWithdrawals) {
header('Content-Type: application/json; charset=utf-8');
$withdrawals = Database::getAllWithdrawals(100);
$openCount = 0;
$rows = [];
$typeNames = ['charge' => 'شارژ', 'stars' => 'استارز', 'card' => 'کارت به کارت'];
foreach ($withdrawals as $w) {
// "Open" = any non-terminal status (waiting for admin action).
if (!in_array($w['status'], ['closed', 'approved', 'rejected', 'paid'], true)) $openCount++;
$rows[] = [
'id' => (int)$w['id'],
'user_id' => (string)$w['user_id'],
'type' => $w['type'],
'type_label' => $typeNames[$w['type']] ?? $w['type'],
'status' => $w['status'],
'admin_name' => $w['admin_name'] ?? '',
'question_time'=> $w['question_time'] ?? '',
'amount' => (int)($w['amount'] ?? 0),
'operator' => $w['operator'] ?? '',
];
}
echo json_encode(['total' => count($rows), 'open' => $openCount, 'rows' => $rows]);
exit;
}
// Initial pre-render (for SSR fallback before AJAX fires). Both lists are
// always fetched so the open-count badges on both tab buttons are correct
// regardless of which tab is the SSR default.
$tickets = $canTickets ? Database::getAllTickets(100) : [];
$ticketOpenCount = 0;
foreach ($tickets as $t) { if ($t['status'] !== 'closed') $ticketOpenCount++; }
$withdrawals = $canWithdrawals ? Database::getAllWithdrawals(100) : [];
$withdrawalOpenCount = 0;
foreach ($withdrawals as $w) {
if (!in_array($w['status'], ['closed', 'approved', 'rejected', 'paid'], true)) $withdrawalOpenCount++;
}
require __DIR__ . '/layout_top.php';
?>
>
تیکتها ()
بهصورت خودکار بهروز میشود
| # | کاربر | پیام | وضعیت | پاسخدهنده | زمان | عملیات |
>
درخواست برداشت در انتظار بررسی است.
درخواستهای برداشت ()
بهصورت خودکار بهروز میشود
| # | کاربر | نوع | وضعیت | پاسخدهنده | زمان | عملیات |