<?php
header('Content-Type: application/json');
require_once 'config.php';

// Check authentication and authorization
requireRole(['Admin']);

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die(json_encode(['error' => 'Method not allowed']));
}

$data = json_decode(file_get_contents('php://input'), true);

// Validate input
if (!isset($data['username']) || !isset($data['email']) || !isset($data['password']) || !isset($data['role'])) {
    http_response_code(400);
    die(json_encode(['error' => 'Missing required fields: username, email, password, role']));
}

$result = createUser($data['username'], $data['email'], $data['password'], $data['role']);

if ($result['success']) {
    http_response_code(201);
} else {
    http_response_code(400);
}

die(json_encode($result));