<?php
session_start();
require_once "db.php";

$error = "";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? "");
    $password = trim($_POST['password'] ?? "");

    $stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
    $stmt->execute([$username]);
    $user = $stmt->fetch();

    if (!$user || !password_verify($password, $user['password_hash'])) {
        $error = "Invalid username or password.";
    } else {
        $_SESSION['user_id'] = $user['id'];
        $_SESSION['username'] = $user['username'];
        $_SESSION['is_over_18'] = $user['is_over_18'];

        header("Location: index.php");
        exit;
    }
}
?>
<!DOCTYPE html>
<html>
<head>
  <meta charset="UTF-8">
  <title>Login</title>
  <script src="https://cdn.tailwindcss.com"></script>
</head>
<body class="bg-slate-50">

<div class="max-w-md mx-auto mt-20 bg-white p-6 rounded-xl shadow">
  <h1 class="text-xl font-semibold mb-4">Login</h1>

  <?php if ($error): ?>
    <div class="mb-4 text-red-600 text-sm"><?= htmlspecialchars($error) ?></div>
  <?php endif; ?>

  <form method="POST">
    <label class="block mb-2 text-sm">Username</label>
    <input name="username" required class="w-full px-3 py-2 border rounded mb-4">

    <label class="block mb-2 text-sm">Password</label>
    <input type="password" name="password" required class="w-full px-3 py-2 border rounded mb-4">

    <button class="w-full bg-teal-600 text-white py-2 rounded hover:bg-teal-700">
      Login
    </button>
  </form>

  <p class="text-sm text-center mt-4">
    No account?
    <a href="register.php" class="text-teal-600">Register</a>
  </p>
</div>

</body>
</html>