<?php
session_start();

include './includes/db.php';

// Prevent logged-in admin from accessing login page
if (isset($_SESSION['admin_logged_in']) && $_SESSION['admin_logged_in'] === true) {
    header("Location: dashboard.php");
    exit;
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = trim($_POST['username']);
    $password = trim($_POST['password']);

    $stmt = $conn->prepare("SELECT * FROM admins WHERE username = ?");
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();
    $admin = $result->fetch_assoc();

    if ($admin && password_verify($password, $admin['password'])) {
      $_SESSION['admin_logged_in'] = true; // Assuming login is successful
      $_SESSION['admin_username'] = $admin['username'];
      header("Location: dashboard.php");
      exit();
    } else {
        $error = "Invalid username or password!";
    }
}
?>


<?php include './includes/header.php'; ?>
<div class="container mt-4">
    <h2>Admin Login</h2>
    <?php if (isset($error)) { ?>
        <div class='alert alert-danger'><?= htmlspecialchars($error) ?></div>
    <?php } ?>
    <form method="POST" action="">
        <div class="mb-3">
            <label class="form-label">Username</label>
            <input type="text" name="username" class="form-control" required>
        </div>
        <div class="mb-3">
            <label class="form-label">Password</label>
            <input type="password" name="password" class="form-control" required>
        </div>
        <button type="submit" class="btn btn-primary">Login</button>
    </form>
</div>
<?php include './includes/footer.php'; ?>
