<?php
require __DIR__ . '/_auth.php';

if (admin_is_logged_in()) {
    admin_redirect('index.php');
}

$error = '';
$pdo = db();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!$pdo) {
        $error = 'MySQL is not configured yet. Import database/schema.sql and update data/database.php.';
    } elseif (!verify_csrf_token((string) (isset($_POST['csrf_token']) ? $_POST['csrf_token'] : ''))) {
        $error = 'Security token expired. Please try again.';
    } else {
        $username = trim((string) (isset($_POST['username']) ? $_POST['username'] : ''));
        $password = (string) (isset($_POST['password']) ? $_POST['password'] : '');

        try {
            $stmt = $pdo->prepare('SELECT * FROM admins WHERE username = ? LIMIT 1');
            $stmt->execute(array($username));
            $admin = $stmt->fetch();

            if ($admin && password_verify($password, $admin['password_hash'])) {
                session_regenerate_id(true);
                $_SESSION['admin_id'] = (int) $admin['id'];
                $_SESSION['admin_name'] = (string) $admin['full_name'];
                $_SESSION['admin_username'] = (string) $admin['username'];
                admin_redirect('index.php');
            }

            $error = 'Invalid username or password.';
        } catch (Exception $e) {
            $error = 'Admin table not found. Please import database/schema.sql first.';
        }
    }
}

$title = 'Admin Login';
require __DIR__ . '/_header.php';
?>
<div class="login-panel admin-card p-4 p-lg-5">
    <div class="text-center mb-4">
        <span class="brand-mark d-inline-block mb-3" aria-hidden="true"></span>
        <p class="eyebrow mb-2">Store Admin</p>
        <h1 class="h3 mb-2">Login to manage products and orders</h1>
        <p class="admin-muted mb-0">MySQL mode is required for admin dashboard.</p>
    </div>

    <?php if (!$pdo): ?>
        <div class="alert alert-warning">
            MySQL is not configured yet. Import <code>database/schema.sql</code>, then edit <code>data/database.php</code>.
        </div>
    <?php endif; ?>

    <?php if ($error): ?>
        <div class="alert alert-danger"><?= e($error) ?></div>
    <?php endif; ?>

    <form method="post" autocomplete="off">
        <input type="hidden" name="csrf_token" value="<?= e(csrf_token()) ?>">
        <div class="mb-3">
            <label class="form-label" for="username">Username</label>
            <input class="form-control form-control-lg" id="username" name="username" required value="admin">
        </div>
        <div class="mb-3">
            <label class="form-label" for="password">Password</label>
            <input class="form-control form-control-lg" id="password" name="password" type="password" required>
            <div class="form-help">Default after SQL import: <strong>Admin@12345</strong>. Change it after first login.</div>
        </div>
        <button class="btn btn-primary btn-lg w-100" type="submit">Login</button>
    </form>
</div>
<?php require __DIR__ . '/_footer.php'; ?>
