<?php
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/functions.php';

if (current_user()) {
    header('Location: index.php');
    exit;
}

$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_check();
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    if (attempt_login($username, $password)) {
        header('Location: index.php');
        exit;
    }
    $error = 'Invalid username or password.';
}
$csrf = csrf_token();
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Admin Login — Delmas Careers</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css" rel="stylesheet">
<link href="assets/admin.css" rel="stylesheet">
</head>
<body class="admin-login-body">
<div class="login-card">
  <h4 class="mb-1" style="color:#c9a96e">Delmas Careers</h4>
  <p class="text-muted small mb-4">Admin sign in</p>
  <?php if ($error): ?><div class="alert alert-danger py-2"><?= h($error) ?></div><?php endif; ?>
  <form method="post">
    <input type="hidden" name="csrf" value="<?= h($csrf) ?>">
    <div class="mb-3"><label class="form-label">Username</label>
      <input class="form-control" name="username" required autofocus></div>
    <div class="mb-3"><label class="form-label">Password</label>
      <input class="form-control" type="password" name="password" required></div>
    <button class="btn btn-gold w-100" type="submit">Sign In</button>
  </form>
</div>
<script>document.addEventListener('contextmenu', e => e.preventDefault());</script>
</body>
</html>
