<?php
// Ini gw tambahin debuging (minimal kasih notif anjir kalo eror login, biar gak langsung diarahin ke tampilan putih doang)
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

// ini security punya lu sebelumnya misah blok php
header("X-Frame-Options: SAMEORIGIN");
header("X-Content-Type-Options: nosniff");
header("X-XSS-Protection: 1; mode=block");
header("Referrer-Policy: no-referrer-when-downgrade");
header("Content-Security-Policy: default-src 'self' https: data:; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;");
session_start();
include '../config.php'; 

// Mas ini Proses Login gw satuin blok phpnya 
$error = '';
$username_input = ''; 
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    
    $username_input = $username; 

    if ($username === '' || $password === '') {
        $error = 'Masukkan username dan password.';
    } else {
        $stmt = $conn->prepare("SELECT id, username, password_hash FROM admin WHERE username = ? LIMIT 1");
        if ($stmt === false) {
             $error = 'Gagal menyiapkan query.';
        } else {
            $stmt->bind_param("s", $username);
            $stmt->execute();
            $res = $stmt->get_result();

            if ($res && $res->num_rows === 1) {
                $row = $res->fetch_assoc();
                $input_hash = hash('sha256', $password);
                $is_password_valid = hash_equals($row['password_hash'], $input_hash);

                if ($is_password_valid) {
                    session_regenerate_id(true); 
                    $_SESSION['admin_logged_in'] = true;
                    $_SESSION['admin_id'] = (int)$row['id'];
                    $_SESSION['admin_username'] = $row['username'];
                    
                    $stmt->close(); 
                    header('Location: dashboard.php');
                    exit; 
                } else { 
                    $error = 'Password salah.'; 
                }
            } else { 
                $error = 'Username tidak ditemukan.'; 
            }

            if (isset($stmt) && $stmt !== false) {
                $stmt->close();
            }
        }
    }
}
?>

<!doctype html>
<html lang="id">
<head>
    <meta charset="utf-8">
    <title>Login Admin</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        body {
            background-color: #f8f9fa;
        }
    </style>
</head>
<body class="d-flex align-items-center justify-content-center vh-100">
    <div class="card p-4 shadow" style="width:360px">
        <h4 class="mb-3 text-center">Login Admin</h4>
        
        <?php if($error): ?>
            <div class="alert alert-danger small"><?= htmlspecialchars($error) ?></div>
        <?php endif; ?>
        
        <form method="post" autocomplete="off">
            <div class="mb-2">
                <label class="form-label">Username</label>
                <input name="username" class="form-control" required value="<?= htmlspecialchars($username_input) ?>">
            </div>
            <div class="mb-3">
                <label class="form-label">Password</label>
                <input name="password" type="password" class="form-control" required placeholder="">
            </div>
            <div class="d-grid">
                <button class="btn btn-primary">Login</button>
            </div>
        </form>
    </div>
</body>
</html>