<?php
session_start();
require_once __DIR__ . '/../config/config.php';

if (!isset($_POST['uname'], $_POST['pswd'])
    || !is_string($_POST['uname']) || !is_string($_POST['pswd'])) {
    $_SESSION['login_error'] = 'Please fill in all fields.';
    header('Location: ../index.php');
    exit;
}

$username = trim($_POST['uname']);
$password = $_POST['pswd'];
$loginSuccessful = false;
$database = getDatabaseConnection();

try {
    $statement = $database->prepare('SELECT uname, pswd, admin, defPath, downPer, delPer, upPer FROM users WHERE uname = ?');
    $statement->bind_param('s', $username);
    $statement->execute();
    $result = $statement->get_result();

    while ($user = $result->fetch_assoc()) {
        if (!password_verify($password, $user['pswd'])) {
            continue;
        }
        session_regenerate_id(true);
        $_SESSION['uname'] = $user['uname'];
        $_SESSION['admin'] = (bool) $user['admin'];
        $_SESSION['defPath'] = $user['defPath'];
        foreach (['downPer', 'delPer', 'upPer'] as $permission) {
            $_SESSION[$permission] = (bool) $user[$permission];
        }
        unset($_SESSION['login_error']);
        $loginSuccessful = true;
        break;
    }
    $result->free();
    $statement->close();
    if (!$loginSuccessful) {
        $_SESSION['login_error'] = 'Invalid username or password.';
    }
} catch (mysqli_sql_exception $exception) {
    error_log($exception->getMessage());
    $_SESSION['login_error'] = 'Database error. Please try again.';
} finally {
    $database->close();
}

header('Location: ' . ($loginSuccessful ? 'ftp/index.php' : '../index.php'));
exit;