<?php ob_start(); ?>
<div class="card">
  <h2>Add User</h2>
  <?php if(!empty($errors)) foreach($errors as $e) echo '<p class="error">'.htmlspecialchars($e).'</p>'; ?>
  <form method="post" onsubmit="return validateUserForm(this)">
    <input type="hidden" name="csrf" value="<?php echo htmlspecialchars(csrf_token()); ?>">
    <div class="form-row">
      <div class="field"><label>Username</label><input name="username" required class="form-control"></div>
      <div class="field"><label>Full name</label><input name="fullname" class="form-control"></div>
    </div>
    <div class="form-row"><div class="field"><label>Password</label><input type="password" name="password" required class="form-control"></div><div class="field"><label>Role</label><select name="role"><option value="user">User</option><option value="admin">Admin</option></select></div></div>
    <div style="margin-top:12px"><button type="submit" class="btn btn-primary">Create</button> <a href="index.php?controller=user&action=index" class="btn btn-secondary">Cancel</a></div>
  </form>
</div>
<?php $content = ob_get_clean(); include __DIR__ . '/../layout.php'; ?>
