<?php
require_once __DIR__ . '/includes/auth.php';
require_once __DIR__ . '/includes/rate-limit.php';

$page_title = 'Member Login';
$page_description = 'Log in to your Buy Local Lowveld member account.';

$error = '';
$next  = $_GET['next'] ?? 'member/welcome.php';

// Already logged in? Skip the form.
if (auth_check()) {
    header('Location: ' . $next);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    rate_limit_enforce('login', RL_LOGIN);
    csrf_verify();
    $email    = trim($_POST['email'] ?? '');
    $password = $_POST['password'] ?? '';

    if (!$email || !$password) {
        $error = 'Please enter your email and password.';
    } else {
        $user = auth_login($email, $password);
        if ($user) {
            header('Location: ' . ($_POST['next'] ?? 'member/welcome.php'));
            exit;
        }
        $error = 'Those credentials don\'t match a member account. If you\'ve just signed up, your account is still pending verification.';
    }
}

require 'includes/header.php';
?>

<section class="page-banner">
    <div class="container">
        <h1>Member Login</h1>
        <p>Access your member dashboard, edit your listing, and manage your membership.</p>
    </div>
</section>

<section class="section">
    <div class="container" style="max-width:480px;">

        <?php if ($error): ?>
            <div class="alert alert-error"><?= htmlspecialchars($error) ?></div>
        <?php endif; ?>

        <?php if (isset($_GET['registered'])): ?>
            <div class="alert alert-success" data-autohide>
                Your account has been created. Sign in below.
            </div>
        <?php endif; ?>

        <?php if (isset($_GET['reset'])): ?>
            <div class="alert alert-success" data-autohide>
                Your password has been updated. Sign in with your new password.
            </div>
        <?php endif; ?>

        <?php if (isset($_GET['loggedout'])): ?>
            <div class="alert alert-info" data-autohide>You've been signed out.</div>
        <?php endif; ?>

        <div class="card">
            <h2>Sign in</h2>
            <form method="post" action="login.php">
                <?= csrf_field() ?>
                <input type="hidden" name="next" value="<?= htmlspecialchars($next) ?>">

                <label for="email">Email</label>
                <input type="email" id="email" name="email" required autofocus value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">

                <label for="password">Password</label>
                <input type="password" id="password" name="password" required>

                <button type="submit" class="btn btn-block mt-3">Log in</button>

                <div class="mt-2" style="text-align:center;font-size:.9rem;">
                    <a href="forgot-password.php">Forgot your password?</a>
                    &nbsp;&middot;&nbsp;
                    <a href="claim-business.php">Claim your business</a>
                </div>
            </form>
        </div>

        <p class="text-center mt-3 muted">
            Not a member yet? <a href="become-member.php">Join in 5 minutes &rarr;</a>
        </p>
    </div>
</section>

<?php require 'includes/footer.php'; ?>
