<?php
if (session_status() === PHP_SESSION_NONE) session_start();

require_once __DIR__ . '/inc/master_db.php';
require_once __DIR__ . '/inc/csrf.php';

// Already logged in — go to dashboard
if (!empty($_SESSION['saas_admin']['id'])) {
    header('Location: index.php');
    exit();
}

$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';

    if ($username === '' || $password === '') {
        $error = 'Username and password are required.';
    } else {
        $db   = get_master_connection();
        $stmt = $db->prepare("SELECT id, username, password_hash, full_name, role FROM saas_admins WHERE username = ? AND status = 'active' LIMIT 1");
        $stmt->bind_param('s', $username);
        $stmt->execute();
        $res  = $stmt->get_result();
        $admin = $res->fetch_assoc();
        $stmt->close();

        if ($admin && password_verify($password, $admin['password_hash'])) {
            session_regenerate_id(true);
            $_SESSION['saas_admin'] = [
                'id'        => $admin['id'],
                'username'  => $admin['username'],
                'full_name' => $admin['full_name'],
                'role'      => $admin['role'],
            ];
            $redirect = $_SESSION['saas_admin_redirect'] ?? 'index.php';
            unset($_SESSION['saas_admin_redirect']);
            header('Location: ' . $redirect);
            exit();
        } else {
            $error = 'Invalid username or password.';
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Admin Login — EdumacFlo SaaS</title>
    <meta name="robots" content="noindex,nofollow">
    <link rel="stylesheet" href="assets/admin.css">
</head>
<body>
<div class="login-page">
    <div class="login-box">
        <div class="login-logo">
            <div class="logo-icon">🏫</div>
            <h1>EdumacFlo</h1>
            <p>SaaS Platform Administration</p>
        </div>

        <?php if ($error): ?>
            <div class="flash flash-error">⚠ <?= htmlspecialchars($error) ?></div>
        <?php endif; ?>

        <form method="POST" autocomplete="off">
            <?= csrf_field() ?>
            <div class="form-group">
                <label for="username">Username</label>
                <input type="text" id="username" name="username" autofocus
                       value="<?= htmlspecialchars($_POST['username'] ?? '') ?>"
                       placeholder="superadmin" required>
            </div>
            <div class="form-group" style="margin-top:12px">
                <label for="password">Password</label>
                <input type="password" id="password" name="password" placeholder="••••••••" required>
            </div>
            <button type="submit" class="btn btn-primary" style="margin-top:18px">Sign In to Admin Panel</button>
        </form>

        <p class="text-muted" style="text-align:center;margin-top:20px">
            Restricted access — authorised personnel only.
        </p>
    </div>
</div>
</body>
</html>
