Refactor admin panel: enhance user management and security features

- Added role-based access control for user management links in admin navigation.
- Improved user account display with a dedicated account link.
- Implemented form submission confirmation for delete actions in the admin interface.
- Introduced a password visibility toggle on the login page.
- Added login throttling to prevent brute-force attacks, recording failed attempts.
- Created a CLI script for creating an admin user, replacing the previous hardcoded admin credentials.
- Updated database schema to support login attempt tracking.
- Enhanced user editing functionality, allowing role changes with restrictions.
- Improved modal handling for user actions, ensuring better focus management.
- Added styles for new account management page and improved modal transitions.

inc/users.php

@@ -11,6 +11,8 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/db.php';
 
+const MIN_PASSWORD_LENGTH = 12;
+
 function get_all_users(): array {
     $pdo = get_db();
     $stmt = $pdo->query("SELECT id, username, role, is_enabled, created_at FROM users ORDER BY username ASC");
@@ -41,6 +43,19 @@ function toggle_user_enabled(int $id): bool {
     return $stmt->execute([$id]);
 }
 
+function validate_username(string $username): ?string {
+    if ($username === '') {
+        return 'Username is required.';
+    }
+    if (strlen($username) < 3 || strlen($username) > 32) {
+        return 'Username must be between 3 and 32 characters.';
+    }
+    if (!preg_match('/^[a-zA-Z0-9_.-]+$/', $username)) {
+        return 'Username can only contain letters, numbers, and . _ -';
+    }
+    return null;
+}
+
 function username_exists(string $username, ?int $excludeId = null): bool {
     $pdo = get_db();
     if ($excludeId !== null) {
@@ -61,6 +76,12 @@ function create_user(string $username, string $password, string $role): int {
     return (int) $pdo->lastInsertId();
 }
 
+function update_user(int $id, string $username, string $role): bool {
+    $pdo = get_db();
+    $stmt = $pdo->prepare("UPDATE users SET username = ?, role = ? WHERE id = ?");
+    return $stmt->execute([$username, $role, $id]);
+}
+
 function set_user_password(int $id, string $newPassword): bool {
     $pdo = get_db();
     $hash = password_hash($newPassword, PASSWORD_DEFAULT);