expand on admin functionality, hardening still needs to be implemented.

handlers/admin/draws.go

@@ -0,0 +1,72 @@
+package handlers
+
+import (
+	"database/sql"
+	"html/template"
+	"net/http"
+
+	helpers "synlotto-website/helpers"
+)
+
+func NewDrawHandler(db *sql.DB) http.HandlerFunc {
+	return helpers.AuthMiddleware(func(w http.ResponseWriter, r *http.Request) {
+		context := helpers.TemplateContext(w, r)
+
+		if r.Method == http.MethodPost {
+			game := r.FormValue("game_type")
+			date := r.FormValue("draw_date")
+			machine := r.FormValue("machine")
+			ballset := r.FormValue("ball_set")
+
+			_, err := db.Exec(`INSERT INTO results_thunderball (game_type, draw_date, machine, ball_set) VALUES (?, ?, ?, ?)`,
+				game, date, machine, ballset)
+			if err != nil {
+				http.Error(w, "Failed to add draw", http.StatusInternalServerError)
+				return
+			}
+
+			http.Redirect(w, r, "/admin/dashboard", http.StatusSeeOther)
+			return
+		}
+
+		tmpl := template.Must(template.New("new_draw").Funcs(helpers.TemplateFuncs()).ParseFiles(
+			"templates/layout.html",
+			"templates/admin/draws/new_draw.html",
+		))
+		tmpl.ExecuteTemplate(w, "layout", context)
+	})
+}
+
+func ModifyDrawHandler(db *sql.DB) http.HandlerFunc {
+	return helpers.AuthMiddleware(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			id := r.FormValue("id")
+			_, err := db.Exec(`UPDATE results_thunderball SET game_type=?, draw_date=?, ball_set=?, machine=? WHERE id=?`,
+				r.FormValue("game_type"), r.FormValue("draw_date"), r.FormValue("ball_set"), r.FormValue("machine"), id)
+			if err != nil {
+				http.Error(w, "Update failed", http.StatusInternalServerError)
+				return
+			}
+			http.Redirect(w, r, "/admin/dashboard", http.StatusSeeOther)
+			return
+		}
+		// For GET: load draw by ID (pseudo-code)
+		// id := r.URL.Query().Get("id")
+		// query DB, pass into context.Draw
+	})
+}
+
+func DeleteDrawHandler(db *sql.DB) http.HandlerFunc {
+	return helpers.AuthMiddleware(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			id := r.FormValue("id")
+			_, err := db.Exec(`DELETE FROM results_thunderball WHERE id = ?`, id)
+			if err != nil {
+				http.Error(w, "Delete failed", http.StatusInternalServerError)
+				return
+			}
+			http.Redirect(w, r, "/admin/dashboard", http.StatusSeeOther)
+			return
+		}
+	})
+}