<?php 
$pageTitle = 'Edit Customer'; 
require_once __DIR__ . '/../../app/includes/header.php'; 
require_role_access('customer:update'); 

$id = (int)($_GET['id'] ?? 0);
$stmt = db()->prepare('SELECT * FROM customers WHERE id = ?');
$stmt->execute([$id]);
$c = $stmt->fetch();

if (!$c || (current_user()['role'] !== 'admin' && (int)$c['created_by'] !== current_user()['id'])) {
    http_response_code(403);
    exit('Customer not found or permission denied.');
}
?>
<div class="page-head"><div><h1>Edit Customer</h1><p>Update customer record.</p></div></div>
<form class="card app-card p-4" method="post" action="<?= APP_BASE ?>/customers/update.php">
    <?= csrf_field() ?>
    <input type="hidden" name="id" value="<?= $c['id'] ?>">
    <div class="row g-3">
        <div class="col-md-6"><label class="form-label">Customer Name</label><input class="form-control" name="customer_name" value="<?= e($c['customer_name']) ?>" required></div>
        <div class="col-md-6"><label class="form-label">Phone</label><input class="form-control" name="phone" value="<?= e($c['phone']) ?>"></div>
        <div class="col-md-6"><label class="form-label">Email</label><input class="form-control" type="email" name="email" value="<?= e($c['email']) ?>"></div>
        <div class="col-md-6"><label class="form-label">Location</label><input class="form-control" name="location" value="<?= e($c['location']) ?>"></div>
        <div class="col-md-6"><label class="form-label">Customer Type</label><input class="form-control" name="customer_type" value="<?= e($c['customer_type']) ?>" placeholder="Residential, Commercial"></div>
        <div class="col-12"><label class="form-label">Address</label><textarea class="form-control" name="address" rows="3"><?= e($c['address']) ?></textarea></div>
    </div>
    <div class="mt-4"><button class="btn btn-primary">Update Customer</button></div>
</form>
<?php require_once __DIR__ . '/../../app/includes/footer.php'; ?>
