<?php
header('Content-Type: application/json');
require_once 'config.php';

// Check authentication and authorization
requireRole(['Admin']);

try {
    $db = getDB();
    
    if ($_SERVER['REQUEST_METHOD'] === 'GET') {
        // Get all users
        $stmt = $db->query('
            SELECT id, username, email, role, is_active, created_at
            FROM users
            ORDER BY created_at DESC
        ');
        $users = $stmt->fetchAll(PDO::FETCH_ASSOC);
        
        http_response_code(200);
        die(json_encode([
            'success' => true,
            'users' => $users
        ]));
    }

    http_response_code(405);
    die(json_encode(['error' => 'Method not allowed']));

} catch (PDOException $e) {
    http_response_code(500);
    die(json_encode(['error' => 'Database error: ' . $e->getMessage()]));
}