<?php
declare(strict_types=1);

require_once __DIR__ . '/../app/init.php';

if (app_is_logged_in()) {
    app_redirect(app_login_needs_company_selection() ? 'select_company.php' : 'home.php');
}

$error = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    try {
        app_verify_csrf();
        $username = app_normalize_whitespace((string) ($_POST['username'] ?? ''));
        $password = (string) ($_POST['password'] ?? '');

        if ($username === '' || $password === '') {
            throw new RuntimeException('Please enter username and password.');
        }

        if (!app_login_attempt($username, $password)) {
            throw new RuntimeException('Invalid login credentials.');
        }

        app_redirect(app_login_needs_company_selection() ? 'select_company.php' : 'home.php');
    } catch (Throwable $e) {
        $error = $e->getMessage();
    }
}

$bootstrapError = app_bootstrap_error();
?>
<!doctype html>
<html <?= app_html_attrs() ?>>
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title><?= app_escape(app_t((string) app_config('app_name'))) ?> - <?= app_escape(app_t('Login')) ?></title>
  <link rel="icon" href="assets/favicon.svg" type="image/svg+xml">
  <link rel="shortcut icon" href="assets/favicon.svg" type="image/svg+xml">
  <link rel="stylesheet" href="assets/styles.css">
</head>
<body>
<?= app_ui_controls_html('auth') ?>
<main class="auth-shell">
  <section class="auth-card">
    <div class="auth-hero">
      <img src="assets/logo.svg" alt="Orion Accounts ERP" class="auth-logo">
      <h1><?= app_escape((string) app_config('app_name')) ?></h1>
      <p><?= app_escape((string) app_config('app_subtitle')) ?></p>
      <div class="auth-meta">
        <span class="chip">Secure accounting workspace</span>
        <span class="chip">Multi-company and role-based access</span>
      </div>
    </div>

    <form class="auth-form" method="post">
      <?= app_csrf_field() ?>
      <div>
        <h2>Sign In</h2>
        <p class="helper">Use your account to access modules, imports, and report designer.</p>
      </div>

      <?php if ($bootstrapError !== null): ?>
        <div class="alert error">Database bootstrap error: <?= app_escape($bootstrapError) ?></div>
      <?php endif; ?>

      <?php if ($error !== null): ?>
        <div class="alert error"><?= app_escape($error) ?></div>
      <?php endif; ?>

      <div class="stacked">
        <div class="field">
          <label for="username">Username</label>
          <input id="username" name="username" type="text" autocomplete="username" required>
        </div>
        <div class="field">
          <label for="password">Password</label>
          <div class="password-control">
            <input id="password" name="password" type="password" autocomplete="current-password" required>
            <button class="password-toggle" type="button" data-toggle-password data-target="password">Show</button>
          </div>
        </div>
      </div>

      <div class="form-actions">
        <button class="btn btn-primary" type="submit">Login</button>
      </div>
    </form>
  </section>
</main>
<script src="assets/app.js"></script>
</body>
</html>


