<?php
declare(strict_types=1);require_once dirname(__DIR__).'/includes/functions.php';start_session();if(is_logged_in())redirect('/pracownik/');$device=staff_pin_user_from_device();if(!$device)redirect('/admin/login.php');$error='';
if($_SERVER['REQUEST_METHOD']==='POST'){$now=time();$lock=(int)($_SESSION['pin_lock_until']??0);if($lock>$now){$error='Spróbuj ponownie za chwilę.';}else{$pin=preg_replace('/\D+/','',(string)($_POST['pin']??''));$uid=staff_pin_verify_device($pin);if($uid){session_regenerate_id(true);$_SESSION['user_id']=$uid;$_SESSION['csrf_token']=bin2hex(random_bytes(32));unset($_SESSION['pin_failures'],$_SESSION['pin_lock_until']);db()->prepare('UPDATE users SET last_login_at=NOW() WHERE id=?')->execute([$uid]);redirect('/pracownik/');}$fails=(int)($_SESSION['pin_failures']??0)+1;$_SESSION['pin_failures']=$fails;if($fails>=5){$_SESSION['pin_lock_until']=time()+30;$_SESSION['pin_failures']=0;}$error='Nieprawidłowy PIN.';}}
?><!doctype html><html lang="pl"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex,nofollow"><title>Szybki PIN | Polana Smaków</title><link rel="stylesheet" href="<?= e(asset_v('css/staff.css')) ?>">
<!-- TKLM-TRACKING-AUTO -->
<script defer src="/assets/tklm-tracking.js?v=2"></script>
<!-- /TKLM-TRACKING-AUTO -->
</head><body class="staff-pin-body"><main class="staff-pin-card"><img src="<?= e(asset_v('img/logo.png')) ?>" alt="Polana Smaków"><h1><?= e($device['name']?:$device['username']) ?></h1><p>Wpisz PIN do panelu pracownika.</p><?php if($error): ?><div class="staff-flash is-error"><?= e($error) ?></div><?php endif; ?><form method="post"><input name="pin" type="password" inputmode="numeric" pattern="[0-9]{4,6}" maxlength="6" autocomplete="off" autofocus required><button>Wejdź</button></form><a href="/admin/login.php">Zaloguj hasłem</a></main></body></html>