<?php
// =============================================================
//  GET /api/v1/admin_nurses/list
//
//  Rotation Nurse account directory — mirrors app/manage_rotation_
//  nurses.php's own SELECT exactly (same columns, same ordering).
//  Read-only; the write actions are their own endpoints in this
//  module. This is account management (onboarding/deactivating a
//  nurse), distinct from rotations/nurse_list.php's read-only
//  "who's under my charge" roster.
// =============================================================

require_once __DIR__ . '/../_bootstrap.php';

if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    Api::error(405, 'MethodNotAllowed', 'Use GET');
}

$account = api_authenticate();
api_require_permission('view_all_users');

$stmt = $conn->prepare("
    SELECT id, firstname, surname, email, phone, gender, student_id, school_name,
           specialty_id, specialty_name, rotation_status, status, profile,
           created_at, last_login
    FROM rotation_nurses
    ORDER BY created_at DESC
");
$stmt->execute();
$rows = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
$stmt->close();

$specStmt = $conn->query("SELECT id, name FROM specialty WHERE status = 'Active' ORDER BY name");
$specialties = $specStmt->fetch_all(MYSQLI_ASSOC);

Api::success([
    'nurses' => $rows,
    'specialties' => $specialties,
    'can' => [
        'create'     => PermissionManager::sessionCan('create_user'),
        'edit'       => PermissionManager::sessionCan('edit_user'),
        'deactivate' => PermissionManager::sessionCan('deactivate_user'),
        'delete'     => PermissionManager::sessionCan('delete_user'),
    ],
]);
