<?php
/**
 * login.php — Inicio de sesión del administrador.
 * Verifica con password_verify y protege el POST con CSRF.
 */

declare(strict_types=1);

require_once __DIR__ . '/lib/auth.php';
require_once __DIR__ . '/lib/helpers.php';
require_once __DIR__ . '/lib/i18n.php';

// Si ya hay sesión, al dashboard.
if (is_logged_in()) {
    header('Location: dashboard.php');
    exit;
}

$error = '';

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
    csrf_check();
    $username = trim((string) ($_POST['username'] ?? ''));
    $password = (string) ($_POST['password'] ?? '');

    if ($username === '' || $password === '') {
        $error = 'Introduce usuario y contraseña.';
    } elseif (auth_login($username, $password)) {
        header('Location: dashboard.php');
        exit;
    } else {
        $error = 'Credenciales incorrectas.';
    }
}

// Abre el buffer de traducción (se cierra al final del archivo).
i18n_begin();
?>
<!doctype html>
<html lang="<?= e(panel_lang()) ?>" data-bs-theme="dark">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Acceso · IBO Ultra Panel</title>
    <link rel="icon" href="assets/vvveb/img/favicon.ico">
    <link rel="stylesheet" href="assets/vvveb/css/admin.css">
    <link rel="stylesheet" href="assets/vvveb/custom.css?v=<?= @filemtime(__DIR__ . '/assets/vvveb/custom.css') ?>">
</head>
<body class="login-page bg-body">
    <main class="login-card">
        <div class="card shadow-lg border-0">
            <div class="card-body p-4 p-sm-5">
                <div class="text-center mb-4">
                    <span class="login-brand-mark mb-3">IBO</span>
                    <h1 class="h4 mt-3 mb-1">IBO Ultra Panel</h1>
                    <p class="text-body-secondary mb-0">Administración de dispositivos IPTV</p>
                </div>

                <?php if ($error !== ''): ?>
                    <div class="alert alert-danger" role="alert"><?= e($error) ?></div>
                <?php endif; ?>

                <form method="post" action="login.php" autocomplete="off">
                    <?= csrf_field() ?>
                    <div class="mb-3">
                        <label class="form-label" for="username">Usuario</label>
                        <input type="text" class="form-control" id="username" name="username" autofocus required>
                    </div>
                    <div class="mb-4">
                        <label class="form-label" for="password">Contraseña</label>
                        <input type="password" class="form-control" id="password" name="password" required>
                    </div>
                    <button class="btn btn-primary w-100" type="submit">
                        <i class="la la-sign-in-alt"></i> Entrar
                    </button>
                </form>

                <div class="text-center mt-4 small login-langs">
                    <?php foreach (panel_langs() as $code => $name): ?>
                        <a class="me-2 <?= panel_lang() === $code ? 'fw-bold' : 'text-body-secondary' ?>" href="login.php?lang=<?= e($code) ?>"><?= e(strtoupper($code)) ?></a>
                    <?php endforeach; ?>
                </div>
            </div>
        </div>
    </main>
    <script src="assets/vvveb/js/theme.js"></script>
</body>
</html>
<?php
// Cierra el buffer de traducción abierto arriba: traduce y emite.
i18n_end();
