<?php
declare(strict_types=1);

require_once dirname(__DIR__) . '/includes/functions.php';

start_session();

if (is_logged_in()) {
    $existing = admin_user();
    redirect($existing && in_array((string)($existing['role'] ?? ''), ['waiter','kitchen'], true) ? '/pracownik/' : '/admin/');
}

$pinDevice=staff_pin_user_from_device();
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim((string)($_POST['username'] ?? ''));
    $password = (string)($_POST['password'] ?? '');

    $stmt = db()->prepare(
        'SELECT id, username, password_hash, active, role
         FROM users
         WHERE username = ?
         LIMIT 1'
    );
    $stmt->execute([$username]);
    $user = $stmt->fetch();

    if (
        $user &&
        (int)$user['active'] === 1 &&
        password_verify($password, $user['password_hash'])
    ) {
        session_regenerate_id(true);
        $_SESSION['user_id'] = (int)$user['id'];
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        session_mark_login();

        $stmt = db()->prepare('UPDATE users SET last_login_at = NOW() WHERE id = ?');
        $stmt->execute([(int)$user['id']]);

        redirect(in_array((string)($user['role'] ?? ''), ['waiter','kitchen'], true) ? '/pracownik/' : '/admin/');
    }

    $error = 'Nieprawidłowy login lub hasło.';
}
?>
<!doctype html>
<html lang="pl">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="robots" content="noindex,nofollow">
    <title>Panel | Moja Polana Smaków</title>
    <link rel="icon" type="image/png" href="/assets/img/favicon.png">
    <link rel="stylesheet" href="/assets/css/admin.css">
</head>
<body class="login-body">
<div class="login-card login-card-clean">
    <img class="login-logo" src="/assets/img/logo.png" alt="Moja Polana Smaków">

    <?php if ($error): ?>
        <div class="flash flash-error"><?= e($error) ?></div>
    <?php endif; ?>

    <form method="post" autocomplete="on">
        <label>
            Login
            <input type="text" name="username" value="admin" autocomplete="username" required autofocus>
        </label>

        <label>
            Hasło
            <input type="password" name="password" autocomplete="current-password" required>
        </label>

        <button class="btn btn-primary login-submit" type="submit">Zaloguj się</button>
        <small style="display:block;margin-top:10px;color:#777;text-align:center">Sesja pozostaje aktywna do 30 dni od ostatniego użycia.</small>
    </form>
    <?php if($pinDevice): ?><a class="btn btn-light" style="display:block;margin-top:12px;text-align:center" href="/pracownik/pin.php">Szybki PIN · <?= e($pinDevice['name']?:$pinDevice['username']) ?></a><?php endif; ?>
</div>
</body>
</html>