<?php
require_once __DIR__ . '/../app/bootstrap.php';
use App\Core\Auth;
if (Auth::check()) redirect(role_dashboard_url());
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!verify_csrf()) set_flash('error', 'Invalid security token.');
    elseif (Auth::attempt((string)($_POST['email'] ?? ''), (string)($_POST['password'] ?? ''))) redirect(role_dashboard_url());
    else set_flash('error', 'Invalid credentials, inactive account, or too many attempts.');
}
$pageTitle = 'Login | ' . BRAND_NAME;
include ROOT_PATH . '/app/Layouts/frontend_header.php';
?>
<section class="container py-5"><div class="row justify-content-center"><div class="col-md-6 col-lg-5"><div class="card border-0 shadow-sm"><div class="card-body p-4 p-lg-5"><h3>Login</h3>
<?php if($msg=flash('success')): ?><div class="alert alert-success"><?= e($msg) ?></div><?php endif; ?>
<?php if($msg=flash('error')): ?><div class="alert alert-danger"><?= e($msg) ?></div><?php endif; ?>
<form method="post"><?= csrf_field() ?><label class="form-label">Email</label><input name="email" type="email" class="form-control mb-3" required autocomplete="email"><label class="form-label">Password</label><input name="password" type="password" class="form-control mb-3" required autocomplete="current-password"><div class="d-flex justify-content-between mb-3"><a href="<?= url('public/register.php') ?>">Create account</a><a href="<?= url('public/forgot-password.php') ?>">Forgot password?</a></div><button class="btn btn-primary w-100">Login</button></form>
</div></div></div></div></section>
<?php include ROOT_PATH . '/app/Layouts/frontend_footer.php'; ?>
