<?php
require_once __DIR__ . "/config.php";
session_start();

/* ==============================
   LOGIN ATTEMPT CONTROL
============================== */

if (!isset($_SESSION['login_attempts'])) {
    $_SESSION['login_attempts'] = 0;
}

if ($_SESSION['login_attempts'] >= 3) {
    header("Location: login.php?error=Account locked. Contact administrator.");
    exit();
}

/* ==============================
   GET INPUTS
============================== */

$username = trim($_POST['username'] ?? '');
$password = trim($_POST['password'] ?? '');

if ($username === '' || $password === '') {
    header("Location: login.php?error=All fields are required");
    exit();
}

/* ==============================
   ENSURE USERNAME WAS VERIFIED IN STEP 1
============================== */

if (
    !isset($_SESSION['verified_username']) ||
    $_SESSION['verified_username'] !== $username
) {
    header("Location: login.php?error=Please verify your username first");
    exit();
}

/* ==============================
   PREPARE QUERY
============================== */

$stmt = $conn->prepare("
    SELECT id, name, password, is_super_admin, status, photo
    FROM teachers
    WHERE username = ?
    LIMIT 1
");

if (!$stmt) {
    header("Location: login.php?error=System error. Try again.");
    exit();
}

$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();

/* ==============================
   CHECK USER EXISTS
============================== */

if ($result->num_rows !== 1) {

    $_SESSION['login_attempts']++;

    header("Location: login.php?error=Invalid login details");
    exit();
}

/* ==============================
   FETCH USER
============================== */

$teacher = $result->fetch_assoc();

/* ==============================
   CHECK ACCOUNT STATUS
============================== */

if ((int)$teacher['status'] !== 1) {
    header("Location: login.php?error=Account disabled");
    exit();
}

/* ==============================
   VERIFY PASSWORD
============================== */

if (!password_verify($password, $teacher['password'])) {

    $_SESSION['login_attempts']++;

    header("Location: login.php?error=Invalid login details");
    exit();
}

/* ==============================
   LOGIN SUCCESS
============================== */

$_SESSION['login_attempts'] = 0;

/* Prevent session hijacking */
session_regenerate_id(true);

/* Store session data */
$_SESSION['teacher_id']     = $teacher['id'];
$_SESSION['teacher_name']   = $teacher['name'];
$_SESSION['teacher_photo']  = $teacher['photo']; // ✅ FIXED POSITION
$_SESSION['is_super_admin'] = (int)$teacher['is_super_admin'];
$_SESSION['last_activity']  = time();

/* Clear verification flags */
unset($_SESSION['verified_username']);
unset($_SESSION['verified_teacher_id']);

/* Redirect */
header("Location: ../dashboard.php");
exit();