<?php
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';

// Already logged in? Send to dashboard.
if (auth_admin_check()) {
    header('Location: dashboard.php');
    exit;
}

$error = '';
$next  = $_GET['next'] ?? 'dashboard.php';
// Prevent open redirect
if (!preg_match('#^[a-zA-Z0-9_\-./?=&]+$#', $next) || strpos($next, '//') !== false) {
    $next = 'dashboard.php';
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $email    = trim($_POST['email'] ?? '');
    $password = (string)($_POST['password'] ?? '');

    if ($email === '' || $password === '') {
        $error = 'Please enter your email and password.';
    } else {
        $admin = auth_login_admin($email, $password);
        if ($admin) {
            app_log("Admin login: {$admin['email']} (id {$admin['id']})");
            // Send to next page — keep it relative to /admin/
            header('Location: ' . $next);
            exit;
        }
        $error = 'Email or password incorrect, or your account has been deactivated.';
        app_log("FAILED admin login attempt for: $email");
    }
}
?><!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Admin Login — Buy Local Lowveld</title>
<link rel="icon" type="image/png" href="../assets/img/favicon.png">
<style>
*{box-sizing:border-box;}
html,body{margin:0;padding:0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;
    background:#0e0e0e;color:#fff;min-height:100vh;}
body{display:flex;align-items:center;justify-content:center;padding:1rem;
    background:radial-gradient(circle at 50% 0%, #232323 0%, #0e0e0e 60%);}
.al-card{background:#1a1a1a;border:1px solid #2a2a2a;border-radius:14px;padding:2.5rem;width:100%;max-width:420px;box-shadow:0 30px 80px rgba(0,0,0,.6);}
.al-logo{text-align:center;margin-bottom:1.5rem;}
.al-logo img{height:56px;}
.al-title{font-size:1.4rem;font-weight:600;text-align:center;margin:0 0 .25rem;letter-spacing:.02em;}
.al-sub{text-align:center;color:#9a9a9a;font-size:.85rem;margin:0 0 2rem;}
.al-card label{display:block;color:#9a9a9a;font-size:.78rem;text-transform:uppercase;letter-spacing:.08em;font-weight:600;margin-bottom:.4rem;}
.al-card input[type="email"],
.al-card input[type="password"]{
    width:100%;padding:.85rem 1rem;background:#0e0e0e;color:#fff;border:1px solid #2a2a2a;
    border-radius:8px;font-size:1rem;margin-bottom:1.25rem;transition:border-color .15s;
}
.al-card input:focus{outline:none;border-color:#7a9d47;}
.al-btn{width:100%;padding:.95rem;background:#7a9d47;color:#fff;border:none;border-radius:8px;
    font-size:1rem;font-weight:600;letter-spacing:.02em;cursor:pointer;transition:background .15s;}
.al-btn:hover{background:#8db04f;}
.al-error{background:#3b1818;border:1px solid #7a2828;color:#ffabab;padding:.75rem 1rem;border-radius:8px;font-size:.88rem;margin-bottom:1.25rem;}
.al-foot{text-align:center;margin-top:1.5rem;font-size:.85rem;}
.al-foot a{color:#9a9a9a;text-decoration:none;}
.al-foot a:hover{color:#7a9d47;}
.al-divider{height:1px;background:#2a2a2a;margin:1.5rem 0;}
.al-mem-link{display:block;text-align:center;color:#9a9a9a;font-size:.8rem;text-decoration:none;}
.al-mem-link:hover{color:#fff;}
</style>
</head>
<body>

<div class="al-card">
    <div class="al-logo">
        <img src="../assets/img/buylocal-stamp.png" alt="Buy Local Lowveld">
    </div>
    <h1 class="al-title">Admin Sign In</h1>
    <p class="al-sub">Restricted access — staff only</p>

    <?php if ($error): ?>
        <div class="al-error"><?= htmlspecialchars($error) ?></div>
    <?php endif; ?>

    <form method="post" action="login.php?next=<?= urlencode($next) ?>">
        <?= csrf_field() ?>

        <label for="email">Email</label>
        <input id="email" type="email" name="email" required autocomplete="username"
               value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">

        <label for="password">Password</label>
        <input id="password" type="password" name="password" required autocomplete="current-password">

        <button type="submit" class="al-btn">Sign in →</button>
    </form>

    <div class="al-divider"></div>

    <p class="al-foot">
        <a href="forgot.php">Forgot your password?</a>
    </p>
    <a href="../index.php" class="al-mem-link">← Back to public site</a>
</div>

</body>
</html>