<?php

ini_set('session.use_only_cookies', 1);
ini_set('session.use_strict_mode', 1);

$isSecure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');

session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'secure' => $isSecure,   // automatically false on HTTP
    'httponly' => true,
    'samesite' => 'Lax'
]);

session_start();
include "db.php";

error_reporting(E_ALL);
ini_set('display_errors', 1);

$error = "";
$success = "";

if(isset($_POST['login'])){

    $email = trim($_POST['email']);
    $password = $_POST['password'];

    if(empty($email) || empty($password)){
        $error = "All fields are required!";
    } else {

        // Case-insensitive email check
        $stmt = $conn->prepare("SELECT id, fullname, password, role FROM users WHERE LOWER(email) = LOWER(?)");
        $stmt->bind_param("s", $email);
        $stmt->execute();
        $result = $stmt->get_result();

        if($result->num_rows === 1){

            $user = $result->fetch_assoc();

            if(password_verify($password, $user['password'])){

                session_regenerate_id(true);

                $_SESSION['user_id'] = $user['id'];
                $_SESSION['fullname'] = $user['fullname'];
                $_SESSION['role'] = $user['role'];

                // Proper redirect (mobile safe)
                if($user['role'] === 'admin'){
                    header("Location: dashboard.php");
                    exit();
                } else {
                    header("Location: ../index.php");
                    exit();
                }

            } else {
                $error = "Incorrect password!";
            }

        } else {
            $error = "Email not found!";
        }

        $stmt->close();
    }
}
?>

<!DOCTYPE html>
<html>
<head>
<title>Login - ApexUniversalMart</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">

<style>
body{
    margin:0;
    font-family:Segoe UI;
    background:#f4f4f4;
}

.container{
    display:flex;
    justify-content:center;
    align-items:center;
    height:100vh;
}

.box{
    background:white;
    width:400px;
    max-width:90%;
    padding:40px;
    border-radius:10px;
    box-shadow:0 10px 30px rgba(0,0,0,0.08);
}

h2{
    text-align:center;
    color:rgb(242,139,0);
}

input{
    width:100%;
    padding:12px;
    margin-bottom:15px;
    border:1px solid #ddd;
    border-radius:6px;
}

input:focus{
    border-color:rgb(242,139,0);
    outline:none;
}

button{
    width:100%;
    padding:12px;
    background:rgb(242,139,0);
    color:white;
    border:none;
    border-radius:6px;
    font-size:16px;
    cursor:pointer;
}

button:hover{
    background:#d97c00;
}

.error{
    color:red;
    text-align:center;
    margin-bottom:10px;
}

.success{
    color:green;
    text-align:center;
    margin-bottom:10px;
}

p{
    text-align:center;
}
</style>
</head>

<body>

<div class="container">
<div class="box">

<h2>Login</h2>

<?php if(!empty($error)): ?>
    <div class="error"><?php echo $error; ?></div>
<?php endif; ?>

<form method="POST">
    <input type="email" name="email" placeholder="Email Address" required>
    <input type="password" name="password" placeholder="Password" required>
    <button type="submit" name="login">Login</button>
    <p>Not registered? <a href="register.php">Register</a></p>
</form>

</div>
</div>

</body>
</html>