<?php
// superadmin/login.php
session_start();
require_once '../includes/config.php';
require_once '../includes/db.php';

if (!empty($_SESSION[SA_SESSION_KEY])) {
    header('Location: index.php'); exit;
}

$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';

    $pdo  = getDB();
    $stmt = $pdo->prepare("SELECT id, password FROM super_admins WHERE username = ?");
    $stmt->execute([$username]);
    $row  = $stmt->fetch();

    if ($row && password_verify($password, $row['password'])) {
        $_SESSION[SA_SESSION_KEY] = true;
        $_SESSION['sa_id']        = $row['id'];
        $_SESSION['sa_username']  = $username;
        header('Location: index.php'); exit;
    }
    $error = 'Invalid username or password.';
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  <title>Super Admin — Login</title>
  <link rel="stylesheet" href="sa.css" />
</head>
<body>
<div class="login-wrap">
  <div class="login-box">
    <h2>ONVITE</h2>
    <p>Super Admin Panel — Sign in to continue</p>
    <?php if ($error): ?>
      <div class="alert alert-error"><?= htmlspecialchars($error) ?></div>
    <?php endif; ?>
    <form method="post">
      <div class="form-group">
        <label>Username</label>
        <input type="text" name="username" placeholder="superadmin" required autofocus />
      </div>
      <div class="form-group">
        <label>Password</label>
        <input type="password" name="password" placeholder="••••••••" required />
      </div>
      <button type="submit" class="btn btn-primary">Sign In</button>
    </form>
  </div>
</div>
</body>
</html>
