prepare('SELECT * FROM users WHERE id = ? LIMIT 1');
$st->execute([$target]);
$tu = $st->fetch();
if (!$tu) { flash('User not found.', 'error'); redirect('/admin/users.php'); }
switch ($action) {
case 'make_admin':
db()->prepare('UPDATE users SET role="admin" WHERE id=?')->execute([$target]);
audit('grant_admin', $tu['email'], (int)$me['id']); flash('Granted admin to ' . $tu['email'], 'success'); break;
case 'remove_admin':
// Never allow removing the last admin.
$admins = (int) db()->query('SELECT COUNT(*) FROM users WHERE role="admin"')->fetchColumn();
if ($admins <= 1) { flash('Cannot remove the last remaining admin.', 'error'); break; }
db()->prepare('UPDATE users SET role="user" WHERE id=?')->execute([$target]);
audit('revoke_admin', $tu['email'], (int)$me['id']); flash('Removed admin from ' . $tu['email'], 'success'); break;
case 'block':
db()->prepare('UPDATE users SET status="blocked" WHERE id=?')->execute([$target]);
audit('block_user', $tu['email'], (int)$me['id']); flash('Blocked ' . $tu['email'], 'success'); break;
case 'unblock':
db()->prepare('UPDATE users SET status="active" WHERE id=?')->execute([$target]);
audit('unblock_user', $tu['email'], (int)$me['id']); flash('Unblocked ' . $tu['email'], 'success'); break;
}
redirect('/admin/users.php');
}
$users = db()->query('SELECT * FROM users ORDER BY created_at DESC LIMIT 500')->fetchAll();
$page_title = 'Users';
require APP_DIR . '/header.php';
?>
← Admin
Users & admins
Promote any signed-up user to admin, or block accounts.
| User | Role | Status | Actions |
|---|
|
|
Blocked' ?> |
(you)
|