<?php
session_start();
require_once 'config.php';

$usernumber = $password = '';
$usernumber_err = $password_err = $login_err = '';
$show_success = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate usernumber
    if (empty(trim($_POST['usernumber']))) {
        $usernumber_err = 'Please enter your number.';
    } else {
        $usernumber = trim($_POST['usernumber']);
    }

    // Validate password
    if (empty(trim($_POST['password']))) {
        $password_err = 'Please enter your password.';
    } else {
        $password = trim($_POST['password']);
    }

    // Validate credentials
    if (empty($usernumber_err) && empty($password_err)) {
        $sql = 'SELECT id, username, usernumber, password FROM users WHERE usernumber = ? LIMIT 1';
        if ($stmt = mysqli_prepare($link, $sql)) {
            mysqli_stmt_bind_param($stmt, 's', $usernumber);
            mysqli_stmt_execute($stmt);
            mysqli_stmt_store_result($stmt);
            if (mysqli_stmt_num_rows($stmt) == 1) {
                mysqli_stmt_bind_result($stmt, $id, $db_username, $db_usernumber, $hashed_password);
                if (mysqli_stmt_fetch($stmt)) {
                    if (password_verify($password, $hashed_password)) {
                        // Password is correct, start session
                        $_SESSION['loggedin'] = true;
                        $_SESSION['id'] = $id;
                        $_SESSION['username'] = $db_username;
                        $_SESSION['usernumber'] = $db_usernumber;
                        $_SESSION['points_sum'] = 0; // Will be updated in welcome.php
                        header('location: dashboard.php');
                        exit;
                    } else {
                        $login_err = 'Invalid number or password.';
                    }
                }
            } else {
                $login_err = 'Invalid number or password.';
            }
            mysqli_stmt_close($stmt);
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Login</title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
    <?php include 'header.php'; ?>
    <div class="wrapper">
    <h2>Login</h2>
    <?php
        if (!empty($login_err)) echo '<div class="error">'.$login_err.'</div>';
        if (!empty($usernumber_err)) echo '<div class="error">'.$usernumber_err.'</div>';
        if (!empty($password_err)) echo '<div class="error">'.$password_err.'</div>';
    ?>
    <form action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>" method="post">
        <label for="usernumber">Number</label>
        <input class="styled-input" type="text" name="usernumber" id="usernumber" placeholder="Enter your number">
        <label for="password">Password</label>
        <input class="styled-input" type="password" name="password" id="password" placeholder="Enter your password" required>
        <button class="cta" type="submit">Login</button>
    </form>
    <div class="form-links">
        <a href="forgot.php">Forgot password?</a>
        <a href="users.php">Create an account</a>
    </div>
</div>
    <?php include 'footer.php';?>
</body>
</html>