From 50b4a70045084b3173a37f94d85a249c8dd8ab22 Mon Sep 17 00:00:00 2001
From: Philipp Urbschat <philipp.urbschat@gmail.com>
Date: Sat, 12 Sep 2026 23:58:42 +0200
Subject: [PATCH] fix(admin): correctly resolve and check assigned modules and
 admin permissions in user_form

---
 home/app/models/User.php       | 81 +++++++++++++++++++++++++++-------
 home/views/admin/user_form.php |  7 ++-
 2 files changed, 71 insertions(+), 17 deletions(-)

diff --git a/home/app/models/User.php b/home/app/models/User.php
index 42c6337..114b887 100644
--- a/home/app/models/User.php
+++ b/home/app/models/User.php
@@ -5,25 +5,76 @@ class User {
         $this->db = new Database();
     }
     public static function parseProjects($projects): array {
-        if (is_array($projects)) {
-            $list = $projects;
-        } elseif (is_string($projects) && !empty($projects)) {
-            $decoded = json_decode($projects, true);
-            if (json_last_error() === JSON_ERROR_NONE && is_array($decoded)) {
-                $list = $decoded;
-            } else {
-                $list = explode(',', $projects);
-            }
-        } else {
+        if (empty($projects)) {
             return [];
         }
 
+        if (is_string($projects)) {
+            $trimmed = trim($projects);
+            while (is_string($trimmed) && (str_starts_with($trimmed, '[') || str_starts_with($trimmed, '{') || str_starts_with($trimmed, '"'))) {
+                $decoded = json_decode($trimmed, true);
+                if (json_last_error() === JSON_ERROR_NONE && $decoded !== null) {
+                    $trimmed = $decoded;
+                } else {
+                    break;
+                }
+            }
+            if (is_array($trimmed)) {
+                $projects = $trimmed;
+            } else {
+                $projects = explode(',', (string)$trimmed);
+            }
+        }
+
+        if (!is_array($projects)) {
+            return [];
+        }
+
+        $allModules = ModuleService::getAll();
+        $slugMap = [];
+        foreach ($allModules as $s => $m) {
+            $slugMap[strtolower($s)] = $s;
+            $slugMap[strtolower($m['name'])] = $s;
+            $slugMap[strtolower(str_replace([' ', '-', '_'], '', $m['name']))] = $s;
+            $slugMap[strtolower(ltrim($m['path'], '/'))] = $s;
+        }
+        $slugMap['web audio synth'] = 'test';
+        $slugMap['webaudiosynth'] = 'test';
+
         $clean = [];
-        foreach ($list as $item) {
-            if (is_string($item)) {
-                $val = trim($item, " \t\n\r\0\x0B[]\"'");
-                if (!empty($val)) {
-                    $clean[] = $val;
+        foreach ($projects as $key => $val) {
+            $candidates = [];
+            if (is_string($key) && !is_numeric($key)) {
+                if ($val === true || $val === 1 || $val === '1' || $val === 'on' || $val === 'true' || is_array($val)) {
+                    $candidates[] = $key;
+                }
+            } else {
+                if (is_string($val)) {
+                    $candidates[] = $val;
+                } elseif (is_array($val)) {
+                    if (!empty($val['slug'])) $candidates[] = $val['slug'];
+                    elseif (!empty($val['name'])) $candidates[] = $val['name'];
+                    elseif (!empty($val['id'])) $candidates[] = $val['id'];
+                    elseif (!empty($val['project'])) $candidates[] = $val['project'];
+                    else {
+                        foreach ($val as $sub) {
+                            if (is_string($sub)) $candidates[] = $sub;
+                        }
+                    }
+                }
+            }
+
+            foreach ($candidates as $cand) {
+                $sanitized = trim($cand, " \t\n\r\0\x0B[]\"'/");
+                if (empty($sanitized)) continue;
+                $lower = strtolower($sanitized);
+                $normalized = str_replace([' ', '-', '_'], '', $lower);
+                if (isset($slugMap[$lower])) {
+                    $clean[] = $slugMap[$lower];
+                } elseif (isset($slugMap[$normalized])) {
+                    $clean[] = $slugMap[$normalized];
+                } else {
+                    $clean[] = $sanitized;
                 }
             }
         }
diff --git a/home/views/admin/user_form.php b/home/views/admin/user_form.php
index e3e3c00..a611231 100644
--- a/home/views/admin/user_form.php
+++ b/home/views/admin/user_form.php
@@ -2,6 +2,7 @@
 <?php
 $baseUrl = rtrim(Config::get('BASE_URL', 'https://philippurbschat.de/'), '/');
 $userProjects = User::parseProjects($user['projects'] ?? []);
+$isAdmin = !empty($user['is_admin']);
 $modules = $allModules ?? ModuleService::getAll();
 ?>
 <div class="max-w-4xl w-full mx-auto mt-6 px-4 sm:px-6">
@@ -79,7 +80,7 @@ $modules = $allModules ?? ModuleService::getAll();
 
                 <div class="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 gap-3">
                     <?php foreach ($modules as $slug => $mod): 
-                        $isChecked = in_array(strtolower($slug), array_map('strtolower', $userProjects), true);
+                        $isChecked = $isAdmin || in_array(strtolower($slug), array_map('strtolower', $userProjects), true);
                     ?>
                         <label class="flex items-start gap-3 p-3.5 bg-slate-950/70 border border-slate-800 hover:border-emerald-500/50 rounded-xl cursor-pointer transition-all group">
                             <input type="checkbox" name="projects[]" value="<?= htmlspecialchars($slug) ?>" <?= $isChecked ? 'checked' : '' ?> class="module-checkbox mt-1 w-4 h-4 accent-emerald-500">
@@ -119,7 +120,9 @@ function selectAllModules(check) {
     });
 }
 function toggleAdminNotice(adminCheckbox) {
-    // If admin is checked, all checkboxes are accessible anyway
+    if (adminCheckbox.checked) {
+        selectAllModules(true);
+    }
 }
 </script>