<?php
require_once __DIR__ . '/includes/auth.php';

if (!empty($_SESSION['staging_admin_id'])) {
    header('Location: dashboard.php');
    exit;
}

$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    if (!verifyStagingCsrf()) {
        $error = 'Your session expired. Please refresh and try again.';

    } else {

        $email = trim($_POST['email'] ?? '');
        $password = $_POST['password'] ?? '';

        if (!filter_var($email, FILTER_VALIDATE_EMAIL) || $password === '') {

            $error = 'Please enter a valid email and password.';

        } else {

            $stmt = $pdo->prepare("
                SELECT id, name, email, password_hash, role
                FROM staging_admin_users
                WHERE email = ?
                  AND is_active = 1
                LIMIT 1
            ");

            $stmt->execute([$email]);
            $admin = $stmt->fetch(PDO::FETCH_ASSOC);

            if (
                $admin &&
                $admin['role'] === 'super_admin' &&
                password_verify($password, $admin['password_hash'])
            ) {

                session_regenerate_id(true);

                $_SESSION['staging_admin_id'] = (int)$admin['id'];
                $_SESSION['staging_admin_name'] = $admin['name'];
                $_SESSION['staging_admin_email'] = $admin['email'];
                $_SESSION['staging_admin_role'] = $admin['role'];

                unset($_SESSION['staging_csrf_token']);

                header('Location: dashboard.php');
                exit;

            } else {

                $error = 'Invalid email or password.';

            }
        }
    }
}

$csrf = stagingCsrfToken();
?>

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">

<title>TooGoodTravels Central | Admin Login</title>

<style>
* {
    box-sizing: border-box;
}

body {
    margin: 0;
    font-family: Arial, sans-serif;
    background: #f1f5f9;
    min-height: 100vh;
    display: flex;
    align-items: center;
    justify-content: center;
    padding: 20px;
}

.login-box {
    width: 100%;
    max-width: 430px;
    background: #fff;
    padding: 38px;
    border-radius: 16px;
    box-shadow: 0 12px 40px rgba(0,0,0,.08);
}

.logo {
    color: #008000;
    font-size: 27px;
    font-weight: bold;
}

.subtitle {
    color: #64748b;
    font-size: 14px;
    margin-top: 8px;
}

h2 {
    margin-top: 30px;
    color: #1e293b;
}

input {
    width: 100%;
    padding: 15px;
    margin-top: 14px;
    border: 1px solid #cbd5e1;
    border-radius: 8px;
    font-size: 15px;
}

button {
    width: 100%;
    padding: 15px;
    margin-top: 20px;
    background: #008000;
    color: white;
    border: none;
    border-radius: 8px;
    font-size: 16px;
    font-weight: bold;
    cursor: pointer;
}

button:hover {
    background: #006400;
}

.error {
    background: #fee2e2;
    color: #991b1b;
    padding: 12px;
    border-radius: 8px;
    margin: 15px 0;
}

.footer {
    text-align: center;
    color: #94a3b8;
    font-size: 12px;
    margin-top: 25px;
}
</style>
</head>

<body>

<div class="login-box">

    <div class="logo">TooGoodTravels</div>

    <div class="subtitle">
        Central White-Label Flight Management
    </div>

    <h2>Super Admin Login</h2>

    <?php if ($error): ?>
        <div class="error">
            <?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?>
        </div>
    <?php endif; ?>

    <form method="POST" action="">

        <input
            type="hidden"
            name="csrf_token"
            value="<?= htmlspecialchars($csrf, ENT_QUOTES, 'UTF-8') ?>"
        >

        <input
            type="email"
            name="email"
            placeholder="Admin email address"
            autocomplete="username"
            required
        >

        <input
            type="password"
            name="password"
            placeholder="Password"
            autocomplete="current-password"
            required
        >

        <button type="submit">Sign In</button>

    </form>

    <div class="footer">
        Secure staging administration portal
    </div>

</div>

</body>
</html>